xref: /freebsd/sys/net80211/ieee80211_mesh.c (revision d9f0ce31900a48d1a2bfc1c8c86f79d1e831451a)
1 /*-
2  * Copyright (c) 2009 The FreeBSD Foundation
3  * All rights reserved.
4  *
5  * This software was developed by Rui Paulo under sponsorship from the
6  * FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 #include <sys/cdefs.h>
30 #ifdef __FreeBSD__
31 __FBSDID("$FreeBSD$");
32 #endif
33 
34 /*
35  * IEEE 802.11s Mesh Point (MBSS) support.
36  *
37  * Based on March 2009, D3.0 802.11s draft spec.
38  */
39 #include "opt_inet.h"
40 #include "opt_wlan.h"
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/mbuf.h>
45 #include <sys/malloc.h>
46 #include <sys/kernel.h>
47 
48 #include <sys/socket.h>
49 #include <sys/sockio.h>
50 #include <sys/endian.h>
51 #include <sys/errno.h>
52 #include <sys/proc.h>
53 #include <sys/sysctl.h>
54 
55 #include <net/bpf.h>
56 #include <net/if.h>
57 #include <net/if_var.h>
58 #include <net/if_media.h>
59 #include <net/if_llc.h>
60 #include <net/ethernet.h>
61 
62 #include <net80211/ieee80211_var.h>
63 #include <net80211/ieee80211_action.h>
64 #ifdef IEEE80211_SUPPORT_SUPERG
65 #include <net80211/ieee80211_superg.h>
66 #endif
67 #include <net80211/ieee80211_input.h>
68 #include <net80211/ieee80211_mesh.h>
69 
70 static void	mesh_rt_flush_invalid(struct ieee80211vap *);
71 static int	mesh_select_proto_path(struct ieee80211vap *, const char *);
72 static int	mesh_select_proto_metric(struct ieee80211vap *, const char *);
73 static void	mesh_vattach(struct ieee80211vap *);
74 static int	mesh_newstate(struct ieee80211vap *, enum ieee80211_state, int);
75 static void	mesh_rt_cleanup_cb(void *);
76 static void	mesh_gatemode_setup(struct ieee80211vap *);
77 static void	mesh_gatemode_cb(void *);
78 static void	mesh_linkchange(struct ieee80211_node *,
79 		    enum ieee80211_mesh_mlstate);
80 static void	mesh_checkid(void *, struct ieee80211_node *);
81 static uint32_t	mesh_generateid(struct ieee80211vap *);
82 static int	mesh_checkpseq(struct ieee80211vap *,
83 		    const uint8_t [IEEE80211_ADDR_LEN], uint32_t);
84 static void	mesh_transmit_to_gate(struct ieee80211vap *, struct mbuf *,
85 		    struct ieee80211_mesh_route *);
86 static void	mesh_forward(struct ieee80211vap *, struct mbuf *,
87 		    const struct ieee80211_meshcntl *);
88 static int	mesh_input(struct ieee80211_node *, struct mbuf *,
89 		    const struct ieee80211_rx_stats *rxs, int, int);
90 static void	mesh_recv_mgmt(struct ieee80211_node *, struct mbuf *, int,
91 		    const struct ieee80211_rx_stats *rxs, int, int);
92 static void	mesh_recv_ctl(struct ieee80211_node *, struct mbuf *, int);
93 static void	mesh_peer_timeout_setup(struct ieee80211_node *);
94 static void	mesh_peer_timeout_backoff(struct ieee80211_node *);
95 static void	mesh_peer_timeout_cb(void *);
96 static __inline void
97 		mesh_peer_timeout_stop(struct ieee80211_node *);
98 static int	mesh_verify_meshid(struct ieee80211vap *, const uint8_t *);
99 static int	mesh_verify_meshconf(struct ieee80211vap *, const uint8_t *);
100 static int	mesh_verify_meshpeer(struct ieee80211vap *, uint8_t,
101     		    const uint8_t *);
102 uint32_t	mesh_airtime_calc(struct ieee80211_node *);
103 
104 /*
105  * Timeout values come from the specification and are in milliseconds.
106  */
107 static SYSCTL_NODE(_net_wlan, OID_AUTO, mesh, CTLFLAG_RD, 0,
108     "IEEE 802.11s parameters");
109 static int	ieee80211_mesh_gateint = -1;
110 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, gateint, CTLTYPE_INT | CTLFLAG_RW,
111     &ieee80211_mesh_gateint, 0, ieee80211_sysctl_msecs_ticks, "I",
112     "mesh gate interval (ms)");
113 static int ieee80211_mesh_retrytimeout = -1;
114 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, retrytimeout, CTLTYPE_INT | CTLFLAG_RW,
115     &ieee80211_mesh_retrytimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
116     "Retry timeout (msec)");
117 static int ieee80211_mesh_holdingtimeout = -1;
118 
119 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, holdingtimeout, CTLTYPE_INT | CTLFLAG_RW,
120     &ieee80211_mesh_holdingtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
121     "Holding state timeout (msec)");
122 static int ieee80211_mesh_confirmtimeout = -1;
123 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, confirmtimeout, CTLTYPE_INT | CTLFLAG_RW,
124     &ieee80211_mesh_confirmtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
125     "Confirm state timeout (msec)");
126 static int ieee80211_mesh_backofftimeout = -1;
127 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, backofftimeout, CTLTYPE_INT | CTLFLAG_RW,
128     &ieee80211_mesh_backofftimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
129     "Backoff timeout (msec). This is to throutles peering forever when "
130     "not receiving answer or is rejected by a neighbor");
131 static int ieee80211_mesh_maxretries = 2;
132 SYSCTL_INT(_net_wlan_mesh, OID_AUTO, maxretries, CTLFLAG_RW,
133     &ieee80211_mesh_maxretries, 0,
134     "Maximum retries during peer link establishment");
135 static int ieee80211_mesh_maxholding = 2;
136 SYSCTL_INT(_net_wlan_mesh, OID_AUTO, maxholding, CTLFLAG_RW,
137     &ieee80211_mesh_maxholding, 0,
138     "Maximum times we are allowed to transition to HOLDING state before "
139     "backinoff during peer link establishment");
140 
141 static const uint8_t broadcastaddr[IEEE80211_ADDR_LEN] =
142 	{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
143 
144 static	ieee80211_recv_action_func mesh_recv_action_meshpeering_open;
145 static	ieee80211_recv_action_func mesh_recv_action_meshpeering_confirm;
146 static	ieee80211_recv_action_func mesh_recv_action_meshpeering_close;
147 static	ieee80211_recv_action_func mesh_recv_action_meshlmetric;
148 static	ieee80211_recv_action_func mesh_recv_action_meshgate;
149 
150 static	ieee80211_send_action_func mesh_send_action_meshpeering_open;
151 static	ieee80211_send_action_func mesh_send_action_meshpeering_confirm;
152 static	ieee80211_send_action_func mesh_send_action_meshpeering_close;
153 static	ieee80211_send_action_func mesh_send_action_meshlmetric;
154 static	ieee80211_send_action_func mesh_send_action_meshgate;
155 
156 static const struct ieee80211_mesh_proto_metric mesh_metric_airtime = {
157 	.mpm_descr	= "AIRTIME",
158 	.mpm_ie		= IEEE80211_MESHCONF_METRIC_AIRTIME,
159 	.mpm_metric	= mesh_airtime_calc,
160 };
161 
162 static struct ieee80211_mesh_proto_path		mesh_proto_paths[4];
163 static struct ieee80211_mesh_proto_metric	mesh_proto_metrics[4];
164 
165 MALLOC_DEFINE(M_80211_MESH_PREQ, "80211preq", "802.11 MESH Path Request frame");
166 MALLOC_DEFINE(M_80211_MESH_PREP, "80211prep", "802.11 MESH Path Reply frame");
167 MALLOC_DEFINE(M_80211_MESH_PERR, "80211perr", "802.11 MESH Path Error frame");
168 
169 /* The longer one of the lifetime should be stored as new lifetime */
170 #define MESH_ROUTE_LIFETIME_MAX(a, b)	(a > b ? a : b)
171 
172 MALLOC_DEFINE(M_80211_MESH_RT, "80211mesh_rt", "802.11s routing table");
173 MALLOC_DEFINE(M_80211_MESH_GT_RT, "80211mesh_gt", "802.11s known gates table");
174 
175 /*
176  * Helper functions to manipulate the Mesh routing table.
177  */
178 
179 static struct ieee80211_mesh_route *
180 mesh_rt_find_locked(struct ieee80211_mesh_state *ms,
181     const uint8_t dest[IEEE80211_ADDR_LEN])
182 {
183 	struct ieee80211_mesh_route *rt;
184 
185 	MESH_RT_LOCK_ASSERT(ms);
186 
187 	TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
188 		if (IEEE80211_ADDR_EQ(dest, rt->rt_dest))
189 			return rt;
190 	}
191 	return NULL;
192 }
193 
194 static struct ieee80211_mesh_route *
195 mesh_rt_add_locked(struct ieee80211vap *vap,
196     const uint8_t dest[IEEE80211_ADDR_LEN])
197 {
198 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
199 	struct ieee80211_mesh_route *rt;
200 
201 	KASSERT(!IEEE80211_ADDR_EQ(broadcastaddr, dest),
202 	    ("%s: adding broadcast to the routing table", __func__));
203 
204 	MESH_RT_LOCK_ASSERT(ms);
205 
206 	rt = IEEE80211_MALLOC(ALIGN(sizeof(struct ieee80211_mesh_route)) +
207 	    ms->ms_ppath->mpp_privlen, M_80211_MESH_RT,
208 	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
209 	if (rt != NULL) {
210 		rt->rt_vap = vap;
211 		IEEE80211_ADDR_COPY(rt->rt_dest, dest);
212 		rt->rt_priv = (void *)ALIGN(&rt[1]);
213 		MESH_RT_ENTRY_LOCK_INIT(rt, "MBSS_RT");
214 		callout_init(&rt->rt_discovery, 1);
215 		rt->rt_updtime = ticks;	/* create time */
216 		TAILQ_INSERT_TAIL(&ms->ms_routes, rt, rt_next);
217 	}
218 	return rt;
219 }
220 
221 struct ieee80211_mesh_route *
222 ieee80211_mesh_rt_find(struct ieee80211vap *vap,
223     const uint8_t dest[IEEE80211_ADDR_LEN])
224 {
225 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
226 	struct ieee80211_mesh_route *rt;
227 
228 	MESH_RT_LOCK(ms);
229 	rt = mesh_rt_find_locked(ms, dest);
230 	MESH_RT_UNLOCK(ms);
231 	return rt;
232 }
233 
234 struct ieee80211_mesh_route *
235 ieee80211_mesh_rt_add(struct ieee80211vap *vap,
236     const uint8_t dest[IEEE80211_ADDR_LEN])
237 {
238 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
239 	struct ieee80211_mesh_route *rt;
240 
241 	KASSERT(ieee80211_mesh_rt_find(vap, dest) == NULL,
242 	    ("%s: duplicate entry in the routing table", __func__));
243 	KASSERT(!IEEE80211_ADDR_EQ(vap->iv_myaddr, dest),
244 	    ("%s: adding self to the routing table", __func__));
245 
246 	MESH_RT_LOCK(ms);
247 	rt = mesh_rt_add_locked(vap, dest);
248 	MESH_RT_UNLOCK(ms);
249 	return rt;
250 }
251 
252 /*
253  * Update the route lifetime and returns the updated lifetime.
254  * If new_lifetime is zero and route is timedout it will be invalidated.
255  * new_lifetime is in msec
256  */
257 int
258 ieee80211_mesh_rt_update(struct ieee80211_mesh_route *rt, int new_lifetime)
259 {
260 	int timesince, now;
261 	uint32_t lifetime = 0;
262 
263 	KASSERT(rt != NULL, ("route is NULL"));
264 
265 	now = ticks;
266 	MESH_RT_ENTRY_LOCK(rt);
267 
268 	/* dont clobber a proxy entry gated by us */
269 	if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY && rt->rt_nhops == 0) {
270 		MESH_RT_ENTRY_UNLOCK(rt);
271 		return rt->rt_lifetime;
272 	}
273 
274 	timesince = ticks_to_msecs(now - rt->rt_updtime);
275 	rt->rt_updtime = now;
276 	if (timesince >= rt->rt_lifetime) {
277 		if (new_lifetime != 0) {
278 			rt->rt_lifetime = new_lifetime;
279 		}
280 		else {
281 			rt->rt_flags &= ~IEEE80211_MESHRT_FLAGS_VALID;
282 			rt->rt_lifetime = 0;
283 		}
284 	} else {
285 		/* update what is left of lifetime */
286 		rt->rt_lifetime = rt->rt_lifetime - timesince;
287 		rt->rt_lifetime  = MESH_ROUTE_LIFETIME_MAX(
288 			new_lifetime, rt->rt_lifetime);
289 	}
290 	lifetime = rt->rt_lifetime;
291 	MESH_RT_ENTRY_UNLOCK(rt);
292 
293 	return lifetime;
294 }
295 
296 /*
297  * Add a proxy route (as needed) for the specified destination.
298  */
299 void
300 ieee80211_mesh_proxy_check(struct ieee80211vap *vap,
301     const uint8_t dest[IEEE80211_ADDR_LEN])
302 {
303 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
304 	struct ieee80211_mesh_route *rt;
305 
306 	MESH_RT_LOCK(ms);
307 	rt = mesh_rt_find_locked(ms, dest);
308 	if (rt == NULL) {
309 		rt = mesh_rt_add_locked(vap, dest);
310 		if (rt == NULL) {
311 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
312 			    "%s", "unable to add proxy entry");
313 			vap->iv_stats.is_mesh_rtaddfailed++;
314 		} else {
315 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
316 			    "%s", "add proxy entry");
317 			IEEE80211_ADDR_COPY(rt->rt_mesh_gate, vap->iv_myaddr);
318 			IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
319 			rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
320 				     |  IEEE80211_MESHRT_FLAGS_PROXY;
321 		}
322 	} else if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
323 		KASSERT(rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY,
324 		    ("no proxy flag for poxy entry"));
325 		struct ieee80211com *ic = vap->iv_ic;
326 		/*
327 		 * Fix existing entry created by received frames from
328 		 * stations that have some memory of dest.  We also
329 		 * flush any frames held on the staging queue; delivering
330 		 * them is too much trouble right now.
331 		 */
332 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
333 		    "%s", "fix proxy entry");
334 		IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
335 		rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
336 			     |  IEEE80211_MESHRT_FLAGS_PROXY;
337 		/* XXX belongs in hwmp */
338 		ieee80211_ageq_drain_node(&ic->ic_stageq,
339 		   (void *)(uintptr_t) ieee80211_mac_hash(ic, dest));
340 		/* XXX stat? */
341 	}
342 	MESH_RT_UNLOCK(ms);
343 }
344 
345 static __inline void
346 mesh_rt_del(struct ieee80211_mesh_state *ms, struct ieee80211_mesh_route *rt)
347 {
348 	TAILQ_REMOVE(&ms->ms_routes, rt, rt_next);
349 	/*
350 	 * Grab the lock before destroying it, to be sure no one else
351 	 * is holding the route.
352 	 */
353 	MESH_RT_ENTRY_LOCK(rt);
354 	callout_drain(&rt->rt_discovery);
355 	MESH_RT_ENTRY_LOCK_DESTROY(rt);
356 	IEEE80211_FREE(rt, M_80211_MESH_RT);
357 }
358 
359 void
360 ieee80211_mesh_rt_del(struct ieee80211vap *vap,
361     const uint8_t dest[IEEE80211_ADDR_LEN])
362 {
363 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
364 	struct ieee80211_mesh_route *rt, *next;
365 
366 	MESH_RT_LOCK(ms);
367 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
368 		if (IEEE80211_ADDR_EQ(rt->rt_dest, dest)) {
369 			if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) {
370 				ms->ms_ppath->mpp_senderror(vap, dest, rt,
371 				    IEEE80211_REASON_MESH_PERR_NO_PROXY);
372 			} else {
373 				ms->ms_ppath->mpp_senderror(vap, dest, rt,
374 				    IEEE80211_REASON_MESH_PERR_DEST_UNREACH);
375 			}
376 			mesh_rt_del(ms, rt);
377 			MESH_RT_UNLOCK(ms);
378 			return;
379 		}
380 	}
381 	MESH_RT_UNLOCK(ms);
382 }
383 
384 void
385 ieee80211_mesh_rt_flush(struct ieee80211vap *vap)
386 {
387 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
388 	struct ieee80211_mesh_route *rt, *next;
389 
390 	if (ms == NULL)
391 		return;
392 	MESH_RT_LOCK(ms);
393 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next)
394 		mesh_rt_del(ms, rt);
395 	MESH_RT_UNLOCK(ms);
396 }
397 
398 void
399 ieee80211_mesh_rt_flush_peer(struct ieee80211vap *vap,
400     const uint8_t peer[IEEE80211_ADDR_LEN])
401 {
402 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
403 	struct ieee80211_mesh_route *rt, *next;
404 
405 	MESH_RT_LOCK(ms);
406 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
407 		if (IEEE80211_ADDR_EQ(rt->rt_nexthop, peer))
408 			mesh_rt_del(ms, rt);
409 	}
410 	MESH_RT_UNLOCK(ms);
411 }
412 
413 /*
414  * Flush expired routing entries, i.e. those in invalid state for
415  * some time.
416  */
417 static void
418 mesh_rt_flush_invalid(struct ieee80211vap *vap)
419 {
420 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
421 	struct ieee80211_mesh_route *rt, *next;
422 
423 	if (ms == NULL)
424 		return;
425 	MESH_RT_LOCK(ms);
426 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
427 		/* Discover paths will be deleted by their own callout */
428 		if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_DISCOVER)
429 			continue;
430 		ieee80211_mesh_rt_update(rt, 0);
431 		if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0)
432 			mesh_rt_del(ms, rt);
433 	}
434 	MESH_RT_UNLOCK(ms);
435 }
436 
437 int
438 ieee80211_mesh_register_proto_path(const struct ieee80211_mesh_proto_path *mpp)
439 {
440 	int i, firstempty = -1;
441 
442 	for (i = 0; i < nitems(mesh_proto_paths); i++) {
443 		if (strncmp(mpp->mpp_descr, mesh_proto_paths[i].mpp_descr,
444 		    IEEE80211_MESH_PROTO_DSZ) == 0)
445 			return EEXIST;
446 		if (!mesh_proto_paths[i].mpp_active && firstempty == -1)
447 			firstempty = i;
448 	}
449 	if (firstempty < 0)
450 		return ENOSPC;
451 	memcpy(&mesh_proto_paths[firstempty], mpp, sizeof(*mpp));
452 	mesh_proto_paths[firstempty].mpp_active = 1;
453 	return 0;
454 }
455 
456 int
457 ieee80211_mesh_register_proto_metric(const struct
458     ieee80211_mesh_proto_metric *mpm)
459 {
460 	int i, firstempty = -1;
461 
462 	for (i = 0; i < nitems(mesh_proto_metrics); i++) {
463 		if (strncmp(mpm->mpm_descr, mesh_proto_metrics[i].mpm_descr,
464 		    IEEE80211_MESH_PROTO_DSZ) == 0)
465 			return EEXIST;
466 		if (!mesh_proto_metrics[i].mpm_active && firstempty == -1)
467 			firstempty = i;
468 	}
469 	if (firstempty < 0)
470 		return ENOSPC;
471 	memcpy(&mesh_proto_metrics[firstempty], mpm, sizeof(*mpm));
472 	mesh_proto_metrics[firstempty].mpm_active = 1;
473 	return 0;
474 }
475 
476 static int
477 mesh_select_proto_path(struct ieee80211vap *vap, const char *name)
478 {
479 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
480 	int i;
481 
482 	for (i = 0; i < nitems(mesh_proto_paths); i++) {
483 		if (strcasecmp(mesh_proto_paths[i].mpp_descr, name) == 0) {
484 			ms->ms_ppath = &mesh_proto_paths[i];
485 			return 0;
486 		}
487 	}
488 	return ENOENT;
489 }
490 
491 static int
492 mesh_select_proto_metric(struct ieee80211vap *vap, const char *name)
493 {
494 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
495 	int i;
496 
497 	for (i = 0; i < nitems(mesh_proto_metrics); i++) {
498 		if (strcasecmp(mesh_proto_metrics[i].mpm_descr, name) == 0) {
499 			ms->ms_pmetric = &mesh_proto_metrics[i];
500 			return 0;
501 		}
502 	}
503 	return ENOENT;
504 }
505 
506 static void
507 mesh_gatemode_setup(struct ieee80211vap *vap)
508 {
509 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
510 
511 	/*
512 	 * NB: When a mesh gate is running as a ROOT it shall
513 	 * not send out periodic GANNs but instead mark the
514 	 * mesh gate flag for the corresponding proactive PREQ
515 	 * and RANN frames.
516 	 */
517 	if (ms->ms_flags & IEEE80211_MESHFLAGS_ROOT ||
518 	    (ms->ms_flags & IEEE80211_MESHFLAGS_GATE) == 0) {
519 		callout_drain(&ms->ms_gatetimer);
520 		return ;
521 	}
522 	callout_reset(&ms->ms_gatetimer, ieee80211_mesh_gateint,
523 	    mesh_gatemode_cb, vap);
524 }
525 
526 static void
527 mesh_gatemode_cb(void *arg)
528 {
529 	struct ieee80211vap *vap = (struct ieee80211vap *)arg;
530 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
531 	struct ieee80211_meshgann_ie gann;
532 
533 	gann.gann_flags = 0; /* Reserved */
534 	gann.gann_hopcount = 0;
535 	gann.gann_ttl = ms->ms_ttl;
536 	IEEE80211_ADDR_COPY(gann.gann_addr, vap->iv_myaddr);
537 	gann.gann_seq = ms->ms_gateseq++;
538 	gann.gann_interval = ieee80211_mesh_gateint;
539 
540 	IEEE80211_NOTE(vap, IEEE80211_MSG_MESH, vap->iv_bss,
541 	    "send broadcast GANN (seq %u)", gann.gann_seq);
542 
543 	ieee80211_send_action(vap->iv_bss, IEEE80211_ACTION_CAT_MESH,
544 	    IEEE80211_ACTION_MESH_GANN, &gann);
545 	mesh_gatemode_setup(vap);
546 }
547 
548 static void
549 ieee80211_mesh_init(void)
550 {
551 
552 	memset(mesh_proto_paths, 0, sizeof(mesh_proto_paths));
553 	memset(mesh_proto_metrics, 0, sizeof(mesh_proto_metrics));
554 
555 	/*
556 	 * Setup mesh parameters that depends on the clock frequency.
557 	 */
558 	ieee80211_mesh_gateint = msecs_to_ticks(10000);
559 	ieee80211_mesh_retrytimeout = msecs_to_ticks(40);
560 	ieee80211_mesh_holdingtimeout = msecs_to_ticks(40);
561 	ieee80211_mesh_confirmtimeout = msecs_to_ticks(40);
562 	ieee80211_mesh_backofftimeout = msecs_to_ticks(5000);
563 
564 	/*
565 	 * Register action frame handlers.
566 	 */
567 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
568 	    IEEE80211_ACTION_MESHPEERING_OPEN,
569 	    mesh_recv_action_meshpeering_open);
570 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
571 	    IEEE80211_ACTION_MESHPEERING_CONFIRM,
572 	    mesh_recv_action_meshpeering_confirm);
573 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
574 	    IEEE80211_ACTION_MESHPEERING_CLOSE,
575 	    mesh_recv_action_meshpeering_close);
576 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESH,
577 	    IEEE80211_ACTION_MESH_LMETRIC, mesh_recv_action_meshlmetric);
578 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESH,
579 	    IEEE80211_ACTION_MESH_GANN, mesh_recv_action_meshgate);
580 
581 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
582 	    IEEE80211_ACTION_MESHPEERING_OPEN,
583 	    mesh_send_action_meshpeering_open);
584 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
585 	    IEEE80211_ACTION_MESHPEERING_CONFIRM,
586 	    mesh_send_action_meshpeering_confirm);
587 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
588 	    IEEE80211_ACTION_MESHPEERING_CLOSE,
589 	    mesh_send_action_meshpeering_close);
590 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESH,
591 	    IEEE80211_ACTION_MESH_LMETRIC,
592 	    mesh_send_action_meshlmetric);
593 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESH,
594 	    IEEE80211_ACTION_MESH_GANN,
595 	    mesh_send_action_meshgate);
596 
597 	/*
598 	 * Register Airtime Link Metric.
599 	 */
600 	ieee80211_mesh_register_proto_metric(&mesh_metric_airtime);
601 
602 }
603 SYSINIT(wlan_mesh, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_mesh_init, NULL);
604 
605 void
606 ieee80211_mesh_attach(struct ieee80211com *ic)
607 {
608 	ic->ic_vattach[IEEE80211_M_MBSS] = mesh_vattach;
609 }
610 
611 void
612 ieee80211_mesh_detach(struct ieee80211com *ic)
613 {
614 }
615 
616 static void
617 mesh_vdetach_peers(void *arg, struct ieee80211_node *ni)
618 {
619 	struct ieee80211com *ic = ni->ni_ic;
620 	uint16_t args[3];
621 
622 	if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED) {
623 		args[0] = ni->ni_mlpid;
624 		args[1] = ni->ni_mllid;
625 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
626 		ieee80211_send_action(ni,
627 		    IEEE80211_ACTION_CAT_SELF_PROT,
628 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
629 		    args);
630 	}
631 	callout_drain(&ni->ni_mltimer);
632 	/* XXX belongs in hwmp */
633 	ieee80211_ageq_drain_node(&ic->ic_stageq,
634 	   (void *)(uintptr_t) ieee80211_mac_hash(ic, ni->ni_macaddr));
635 }
636 
637 static void
638 mesh_vdetach(struct ieee80211vap *vap)
639 {
640 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
641 
642 	callout_drain(&ms->ms_cleantimer);
643 	ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_vdetach_peers,
644 	    NULL);
645 	ieee80211_mesh_rt_flush(vap);
646 	MESH_RT_LOCK_DESTROY(ms);
647 	ms->ms_ppath->mpp_vdetach(vap);
648 	IEEE80211_FREE(vap->iv_mesh, M_80211_VAP);
649 	vap->iv_mesh = NULL;
650 }
651 
652 static void
653 mesh_vattach(struct ieee80211vap *vap)
654 {
655 	struct ieee80211_mesh_state *ms;
656 	vap->iv_newstate = mesh_newstate;
657 	vap->iv_input = mesh_input;
658 	vap->iv_opdetach = mesh_vdetach;
659 	vap->iv_recv_mgmt = mesh_recv_mgmt;
660 	vap->iv_recv_ctl = mesh_recv_ctl;
661 	ms = IEEE80211_MALLOC(sizeof(struct ieee80211_mesh_state), M_80211_VAP,
662 	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
663 	if (ms == NULL) {
664 		printf("%s: couldn't alloc MBSS state\n", __func__);
665 		return;
666 	}
667 	vap->iv_mesh = ms;
668 	ms->ms_seq = 0;
669 	ms->ms_flags = (IEEE80211_MESHFLAGS_AP | IEEE80211_MESHFLAGS_FWD);
670 	ms->ms_ttl = IEEE80211_MESH_DEFAULT_TTL;
671 	TAILQ_INIT(&ms->ms_known_gates);
672 	TAILQ_INIT(&ms->ms_routes);
673 	MESH_RT_LOCK_INIT(ms, "MBSS");
674 	callout_init(&ms->ms_cleantimer, 1);
675 	callout_init(&ms->ms_gatetimer, 1);
676 	ms->ms_gateseq = 0;
677 	mesh_select_proto_metric(vap, "AIRTIME");
678 	KASSERT(ms->ms_pmetric, ("ms_pmetric == NULL"));
679 	mesh_select_proto_path(vap, "HWMP");
680 	KASSERT(ms->ms_ppath, ("ms_ppath == NULL"));
681 	ms->ms_ppath->mpp_vattach(vap);
682 }
683 
684 /*
685  * IEEE80211_M_MBSS vap state machine handler.
686  */
687 static int
688 mesh_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
689 {
690 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
691 	struct ieee80211com *ic = vap->iv_ic;
692 	struct ieee80211_node *ni;
693 	enum ieee80211_state ostate;
694 
695 	IEEE80211_LOCK_ASSERT(ic);
696 
697 	ostate = vap->iv_state;
698 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
699 	    __func__, ieee80211_state_name[ostate],
700 	    ieee80211_state_name[nstate], arg);
701 	vap->iv_state = nstate;		/* state transition */
702 	if (ostate != IEEE80211_S_SCAN)
703 		ieee80211_cancel_scan(vap);	/* background scan */
704 	ni = vap->iv_bss;			/* NB: no reference held */
705 	if (nstate != IEEE80211_S_RUN && ostate == IEEE80211_S_RUN) {
706 		callout_drain(&ms->ms_cleantimer);
707 		callout_drain(&ms->ms_gatetimer);
708 	}
709 	switch (nstate) {
710 	case IEEE80211_S_INIT:
711 		switch (ostate) {
712 		case IEEE80211_S_SCAN:
713 			ieee80211_cancel_scan(vap);
714 			break;
715 		case IEEE80211_S_CAC:
716 			ieee80211_dfs_cac_stop(vap);
717 			break;
718 		case IEEE80211_S_RUN:
719 			ieee80211_iterate_nodes(&ic->ic_sta,
720 			    mesh_vdetach_peers, NULL);
721 			break;
722 		default:
723 			break;
724 		}
725 		if (ostate != IEEE80211_S_INIT) {
726 			/* NB: optimize INIT -> INIT case */
727 			ieee80211_reset_bss(vap);
728 			ieee80211_mesh_rt_flush(vap);
729 		}
730 		break;
731 	case IEEE80211_S_SCAN:
732 		switch (ostate) {
733 		case IEEE80211_S_INIT:
734 			if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
735 			    !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan) &&
736 			    ms->ms_idlen != 0) {
737 				/*
738 				 * Already have a channel and a mesh ID; bypass
739 				 * the scan and startup immediately.
740 				 */
741 				ieee80211_create_ibss(vap, vap->iv_des_chan);
742 				break;
743 			}
744 			/*
745 			 * Initiate a scan.  We can come here as a result
746 			 * of an IEEE80211_IOC_SCAN_REQ too in which case
747 			 * the vap will be marked with IEEE80211_FEXT_SCANREQ
748 			 * and the scan request parameters will be present
749 			 * in iv_scanreq.  Otherwise we do the default.
750 			*/
751 			if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
752 				ieee80211_check_scan(vap,
753 				    vap->iv_scanreq_flags,
754 				    vap->iv_scanreq_duration,
755 				    vap->iv_scanreq_mindwell,
756 				    vap->iv_scanreq_maxdwell,
757 				    vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
758 				vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
759 			} else
760 				ieee80211_check_scan_current(vap);
761 			break;
762 		default:
763 			break;
764 		}
765 		break;
766 	case IEEE80211_S_CAC:
767 		/*
768 		 * Start CAC on a DFS channel.  We come here when starting
769 		 * a bss on a DFS channel (see ieee80211_create_ibss).
770 		 */
771 		ieee80211_dfs_cac_start(vap);
772 		break;
773 	case IEEE80211_S_RUN:
774 		switch (ostate) {
775 		case IEEE80211_S_INIT:
776 			/*
777 			 * Already have a channel; bypass the
778 			 * scan and startup immediately.
779 			 * Note that ieee80211_create_ibss will call
780 			 * back to do a RUN->RUN state change.
781 			 */
782 			ieee80211_create_ibss(vap,
783 			    ieee80211_ht_adjust_channel(ic,
784 				ic->ic_curchan, vap->iv_flags_ht));
785 			/* NB: iv_bss is changed on return */
786 			break;
787 		case IEEE80211_S_CAC:
788 			/*
789 			 * NB: This is the normal state change when CAC
790 			 * expires and no radar was detected; no need to
791 			 * clear the CAC timer as it's already expired.
792 			 */
793 			/* fall thru... */
794 		case IEEE80211_S_CSA:
795 #if 0
796 			/*
797 			 * Shorten inactivity timer of associated stations
798 			 * to weed out sta's that don't follow a CSA.
799 			 */
800 			ieee80211_iterate_nodes(&ic->ic_sta, sta_csa, vap);
801 #endif
802 			/*
803 			 * Update bss node channel to reflect where
804 			 * we landed after CSA.
805 			 */
806 			ieee80211_node_set_chan(vap->iv_bss,
807 			    ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
808 				ieee80211_htchanflags(vap->iv_bss->ni_chan)));
809 			/* XXX bypass debug msgs */
810 			break;
811 		case IEEE80211_S_SCAN:
812 		case IEEE80211_S_RUN:
813 #ifdef IEEE80211_DEBUG
814 			if (ieee80211_msg_debug(vap)) {
815 				struct ieee80211_node *ni = vap->iv_bss;
816 				ieee80211_note(vap,
817 				    "synchronized with %s meshid ",
818 				    ether_sprintf(ni->ni_meshid));
819 				ieee80211_print_essid(ni->ni_meshid,
820 				    ni->ni_meshidlen);
821 				/* XXX MCS/HT */
822 				printf(" channel %d\n",
823 				    ieee80211_chan2ieee(ic, ic->ic_curchan));
824 			}
825 #endif
826 			break;
827 		default:
828 			break;
829 		}
830 		ieee80211_node_authorize(vap->iv_bss);
831 		callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
832                     mesh_rt_cleanup_cb, vap);
833 		mesh_gatemode_setup(vap);
834 		break;
835 	default:
836 		break;
837 	}
838 	/* NB: ostate not nstate */
839 	ms->ms_ppath->mpp_newstate(vap, ostate, arg);
840 	return 0;
841 }
842 
843 static void
844 mesh_rt_cleanup_cb(void *arg)
845 {
846 	struct ieee80211vap *vap = arg;
847 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
848 
849 	mesh_rt_flush_invalid(vap);
850 	callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
851 	    mesh_rt_cleanup_cb, vap);
852 }
853 
854 /*
855  * Mark a mesh STA as gate and return a pointer to it.
856  * If this is first time, we create a new gate route.
857  * Always update the path route to this mesh gate.
858  */
859 struct ieee80211_mesh_gate_route *
860 ieee80211_mesh_mark_gate(struct ieee80211vap *vap, const uint8_t *addr,
861     struct ieee80211_mesh_route *rt)
862 {
863 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
864 	struct ieee80211_mesh_gate_route *gr = NULL, *next;
865 	int found = 0;
866 
867 	MESH_RT_LOCK(ms);
868 	TAILQ_FOREACH_SAFE(gr, &ms->ms_known_gates, gr_next, next) {
869 		if (IEEE80211_ADDR_EQ(gr->gr_addr, addr)) {
870 			found = 1;
871 			break;
872 		}
873 	}
874 
875 	if (!found) {
876 		/* New mesh gate add it to known table. */
877 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, addr,
878 		    "%s", "stored new gate information from pro-PREQ.");
879 		gr = IEEE80211_MALLOC(ALIGN(sizeof(struct ieee80211_mesh_gate_route)),
880 		    M_80211_MESH_GT_RT,
881 		    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
882 		IEEE80211_ADDR_COPY(gr->gr_addr, addr);
883 		TAILQ_INSERT_TAIL(&ms->ms_known_gates, gr, gr_next);
884 	}
885 	gr->gr_route = rt;
886 	/* TODO: link from path route to gate route */
887 	MESH_RT_UNLOCK(ms);
888 
889 	return gr;
890 }
891 
892 
893 /*
894  * Helper function to note the Mesh Peer Link FSM change.
895  */
896 static void
897 mesh_linkchange(struct ieee80211_node *ni, enum ieee80211_mesh_mlstate state)
898 {
899 	struct ieee80211vap *vap = ni->ni_vap;
900 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
901 #ifdef IEEE80211_DEBUG
902 	static const char *meshlinkstates[] = {
903 		[IEEE80211_NODE_MESH_IDLE]		= "IDLE",
904 		[IEEE80211_NODE_MESH_OPENSNT]		= "OPEN SENT",
905 		[IEEE80211_NODE_MESH_OPENRCV]		= "OPEN RECEIVED",
906 		[IEEE80211_NODE_MESH_CONFIRMRCV]	= "CONFIRM RECEIVED",
907 		[IEEE80211_NODE_MESH_ESTABLISHED]	= "ESTABLISHED",
908 		[IEEE80211_NODE_MESH_HOLDING]		= "HOLDING"
909 	};
910 #endif
911 	IEEE80211_NOTE(vap, IEEE80211_MSG_MESH,
912 	    ni, "peer link: %s -> %s",
913 	    meshlinkstates[ni->ni_mlstate], meshlinkstates[state]);
914 
915 	/* track neighbor count */
916 	if (state == IEEE80211_NODE_MESH_ESTABLISHED &&
917 	    ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
918 		KASSERT(ms->ms_neighbors < 65535, ("neighbor count overflow"));
919 		ms->ms_neighbors++;
920 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
921 	} else if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED &&
922 	    state != IEEE80211_NODE_MESH_ESTABLISHED) {
923 		KASSERT(ms->ms_neighbors > 0, ("neighbor count 0"));
924 		ms->ms_neighbors--;
925 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
926 	}
927 	ni->ni_mlstate = state;
928 	switch (state) {
929 	case IEEE80211_NODE_MESH_HOLDING:
930 		ms->ms_ppath->mpp_peerdown(ni);
931 		break;
932 	case IEEE80211_NODE_MESH_ESTABLISHED:
933 		ieee80211_mesh_discover(vap, ni->ni_macaddr, NULL);
934 		break;
935 	default:
936 		break;
937 	}
938 }
939 
940 /*
941  * Helper function to generate a unique local ID required for mesh
942  * peer establishment.
943  */
944 static void
945 mesh_checkid(void *arg, struct ieee80211_node *ni)
946 {
947 	uint16_t *r = arg;
948 
949 	if (*r == ni->ni_mllid)
950 		*(uint16_t *)arg = 0;
951 }
952 
953 static uint32_t
954 mesh_generateid(struct ieee80211vap *vap)
955 {
956 	int maxiter = 4;
957 	uint16_t r;
958 
959 	do {
960 		get_random_bytes(&r, 2);
961 		ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_checkid, &r);
962 		maxiter--;
963 	} while (r == 0 && maxiter > 0);
964 	return r;
965 }
966 
967 /*
968  * Verifies if we already received this packet by checking its
969  * sequence number.
970  * Returns 0 if the frame is to be accepted, 1 otherwise.
971  */
972 static int
973 mesh_checkpseq(struct ieee80211vap *vap,
974     const uint8_t source[IEEE80211_ADDR_LEN], uint32_t seq)
975 {
976 	struct ieee80211_mesh_route *rt;
977 
978 	rt = ieee80211_mesh_rt_find(vap, source);
979 	if (rt == NULL) {
980 		rt = ieee80211_mesh_rt_add(vap, source);
981 		if (rt == NULL) {
982 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
983 			    "%s", "add mcast route failed");
984 			vap->iv_stats.is_mesh_rtaddfailed++;
985 			return 1;
986 		}
987 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
988 		    "add mcast route, mesh seqno %d", seq);
989 		rt->rt_lastmseq = seq;
990 		return 0;
991 	}
992 	if (IEEE80211_MESH_SEQ_GEQ(rt->rt_lastmseq, seq)) {
993 		return 1;
994 	} else {
995 		rt->rt_lastmseq = seq;
996 		return 0;
997 	}
998 }
999 
1000 /*
1001  * Iterate the routing table and locate the next hop.
1002  */
1003 struct ieee80211_node *
1004 ieee80211_mesh_find_txnode(struct ieee80211vap *vap,
1005     const uint8_t dest[IEEE80211_ADDR_LEN])
1006 {
1007 	struct ieee80211_mesh_route *rt;
1008 
1009 	rt = ieee80211_mesh_rt_find(vap, dest);
1010 	if (rt == NULL)
1011 		return NULL;
1012 	if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
1013 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
1014 		    "%s: !valid, flags 0x%x", __func__, rt->rt_flags);
1015 		/* XXX stat */
1016 		return NULL;
1017 	}
1018 	if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) {
1019 		rt = ieee80211_mesh_rt_find(vap, rt->rt_mesh_gate);
1020 		if (rt == NULL) return NULL;
1021 		if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
1022 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
1023 			    "%s: meshgate !valid, flags 0x%x", __func__,
1024 			    rt->rt_flags);
1025 			/* XXX stat */
1026 			return NULL;
1027 		}
1028 	}
1029 	return ieee80211_find_txnode(vap, rt->rt_nexthop);
1030 }
1031 
1032 static void
1033 mesh_transmit_to_gate(struct ieee80211vap *vap, struct mbuf *m,
1034     struct ieee80211_mesh_route *rt_gate)
1035 {
1036 	struct ifnet *ifp = vap->iv_ifp;
1037 	struct ieee80211_node *ni;
1038 
1039 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1040 
1041 	ni = ieee80211_mesh_find_txnode(vap, rt_gate->rt_dest);
1042 	if (ni == NULL) {
1043 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1044 		m_freem(m);
1045 		return;
1046 	}
1047 
1048 	/*
1049 	 * Send through the VAP packet transmit path.
1050 	 * This consumes the node ref grabbed above and
1051 	 * the mbuf, regardless of whether there's a problem
1052 	 * or not.
1053 	 */
1054 	(void) ieee80211_vap_pkt_send_dest(vap, m, ni);
1055 }
1056 
1057 /*
1058  * Forward the queued frames to known valid mesh gates.
1059  * Assume destination to be outside the MBSS (i.e. proxy entry),
1060  * If no valid mesh gates are known silently discard queued frames.
1061  * After transmitting frames to all known valid mesh gates, this route
1062  * will be marked invalid, and a new path discovery will happen in the hopes
1063  * that (at least) one of the mesh gates have a new proxy entry for us to use.
1064  */
1065 void
1066 ieee80211_mesh_forward_to_gates(struct ieee80211vap *vap,
1067     struct ieee80211_mesh_route *rt_dest)
1068 {
1069 	struct ieee80211com *ic = vap->iv_ic;
1070 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1071 	struct ieee80211_mesh_route *rt_gate;
1072 	struct ieee80211_mesh_gate_route *gr = NULL, *gr_next;
1073 	struct mbuf *m, *mcopy, *next;
1074 
1075 	IEEE80211_TX_UNLOCK_ASSERT(ic);
1076 
1077 	KASSERT( rt_dest->rt_flags == IEEE80211_MESHRT_FLAGS_DISCOVER,
1078 	    ("Route is not marked with IEEE80211_MESHRT_FLAGS_DISCOVER"));
1079 
1080 	/* XXX: send to more than one valid mash gate */
1081 	MESH_RT_LOCK(ms);
1082 
1083 	m = ieee80211_ageq_remove(&ic->ic_stageq,
1084 	    (struct ieee80211_node *)(uintptr_t)
1085 	    ieee80211_mac_hash(ic, rt_dest->rt_dest));
1086 
1087 	TAILQ_FOREACH_SAFE(gr, &ms->ms_known_gates, gr_next, gr_next) {
1088 		rt_gate = gr->gr_route;
1089 		if (rt_gate == NULL) {
1090 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP,
1091 				rt_dest->rt_dest,
1092 				"mesh gate with no path %6D",
1093 				gr->gr_addr, ":");
1094 			continue;
1095 		}
1096 		if ((rt_gate->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0)
1097 			continue;
1098 		KASSERT(rt_gate->rt_flags & IEEE80211_MESHRT_FLAGS_GATE,
1099 		    ("route not marked as a mesh gate"));
1100 		KASSERT((rt_gate->rt_flags &
1101 			IEEE80211_MESHRT_FLAGS_PROXY) == 0,
1102 			("found mesh gate that is also marked porxy"));
1103 		/*
1104 		 * convert route to a proxy route gated by the current
1105 		 * mesh gate, this is needed so encap can built data
1106 		 * frame with correct address.
1107 		 */
1108 		rt_dest->rt_flags = IEEE80211_MESHRT_FLAGS_PROXY |
1109 			IEEE80211_MESHRT_FLAGS_VALID;
1110 		rt_dest->rt_ext_seq = 1; /* random value */
1111 		IEEE80211_ADDR_COPY(rt_dest->rt_mesh_gate, rt_gate->rt_dest);
1112 		IEEE80211_ADDR_COPY(rt_dest->rt_nexthop, rt_gate->rt_nexthop);
1113 		rt_dest->rt_metric = rt_gate->rt_metric;
1114 		rt_dest->rt_nhops = rt_gate->rt_nhops;
1115 		ieee80211_mesh_rt_update(rt_dest, ms->ms_ppath->mpp_inact);
1116 		MESH_RT_UNLOCK(ms);
1117 		/* XXX: lock?? */
1118 		mcopy = m_dup(m, M_NOWAIT);
1119 		for (; mcopy != NULL; mcopy = next) {
1120 			next = mcopy->m_nextpkt;
1121 			mcopy->m_nextpkt = NULL;
1122 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP,
1123 			    rt_dest->rt_dest,
1124 			    "flush queued frame %p len %d", mcopy,
1125 			    mcopy->m_pkthdr.len);
1126 			mesh_transmit_to_gate(vap, mcopy, rt_gate);
1127 		}
1128 		MESH_RT_LOCK(ms);
1129 	}
1130 	rt_dest->rt_flags = 0; /* Mark invalid */
1131 	m_freem(m);
1132 	MESH_RT_UNLOCK(ms);
1133 }
1134 
1135 /*
1136  * Forward the specified frame.
1137  * Decrement the TTL and set TA to our MAC address.
1138  */
1139 static void
1140 mesh_forward(struct ieee80211vap *vap, struct mbuf *m,
1141     const struct ieee80211_meshcntl *mc)
1142 {
1143 	struct ieee80211com *ic = vap->iv_ic;
1144 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1145 	struct ifnet *ifp = vap->iv_ifp;
1146 	const struct ieee80211_frame *wh =
1147 	    mtod(m, const struct ieee80211_frame *);
1148 	struct mbuf *mcopy;
1149 	struct ieee80211_meshcntl *mccopy;
1150 	struct ieee80211_frame *whcopy;
1151 	struct ieee80211_node *ni;
1152 	int err;
1153 
1154 	/* This is called from the RX path - don't hold this lock */
1155 	IEEE80211_TX_UNLOCK_ASSERT(ic);
1156 
1157 	/*
1158 	 * mesh ttl of 1 means we are the last one receving it,
1159 	 * according to amendment we decrement and then check if
1160 	 * 0, if so we dont forward.
1161 	 */
1162 	if (mc->mc_ttl < 1) {
1163 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1164 		    "%s", "frame not fwd'd, ttl 1");
1165 		vap->iv_stats.is_mesh_fwd_ttl++;
1166 		return;
1167 	}
1168 	if (!(ms->ms_flags & IEEE80211_MESHFLAGS_FWD)) {
1169 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1170 		    "%s", "frame not fwd'd, fwding disabled");
1171 		vap->iv_stats.is_mesh_fwd_disabled++;
1172 		return;
1173 	}
1174 	mcopy = m_dup(m, M_NOWAIT);
1175 	if (mcopy == NULL) {
1176 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1177 		    "%s", "frame not fwd'd, cannot dup");
1178 		vap->iv_stats.is_mesh_fwd_nobuf++;
1179 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1180 		return;
1181 	}
1182 	mcopy = m_pullup(mcopy, ieee80211_hdrspace(ic, wh) +
1183 	    sizeof(struct ieee80211_meshcntl));
1184 	if (mcopy == NULL) {
1185 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1186 		    "%s", "frame not fwd'd, too short");
1187 		vap->iv_stats.is_mesh_fwd_tooshort++;
1188 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1189 		m_freem(mcopy);
1190 		return;
1191 	}
1192 	whcopy = mtod(mcopy, struct ieee80211_frame *);
1193 	mccopy = (struct ieee80211_meshcntl *)
1194 	    (mtod(mcopy, uint8_t *) + ieee80211_hdrspace(ic, wh));
1195 	/* XXX clear other bits? */
1196 	whcopy->i_fc[1] &= ~IEEE80211_FC1_RETRY;
1197 	IEEE80211_ADDR_COPY(whcopy->i_addr2, vap->iv_myaddr);
1198 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1199 		ni = ieee80211_ref_node(vap->iv_bss);
1200 		mcopy->m_flags |= M_MCAST;
1201 	} else {
1202 		ni = ieee80211_mesh_find_txnode(vap, whcopy->i_addr3);
1203 		if (ni == NULL) {
1204 			/*
1205 			 * [Optional] any of the following three actions:
1206 			 * o silently discard
1207 			 * o trigger a path discovery
1208 			 * o inform TA that meshDA is unknown.
1209 			 */
1210 			IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1211 			    "%s", "frame not fwd'd, no path");
1212 			ms->ms_ppath->mpp_senderror(vap, whcopy->i_addr3, NULL,
1213 			    IEEE80211_REASON_MESH_PERR_NO_FI);
1214 			vap->iv_stats.is_mesh_fwd_nopath++;
1215 			m_freem(mcopy);
1216 			return;
1217 		}
1218 		IEEE80211_ADDR_COPY(whcopy->i_addr1, ni->ni_macaddr);
1219 	}
1220 	KASSERT(mccopy->mc_ttl > 0, ("%s called with wrong ttl", __func__));
1221 	mccopy->mc_ttl--;
1222 
1223 	/* XXX calculate priority so drivers can find the tx queue */
1224 	M_WME_SETAC(mcopy, WME_AC_BE);
1225 
1226 	/* XXX do we know m_nextpkt is NULL? */
1227 	mcopy->m_pkthdr.rcvif = (void *) ni;
1228 
1229 	/*
1230 	 * XXX this bypasses all of the VAP TX handling; it passes frames
1231 	 * directly to the parent interface.
1232 	 *
1233 	 * Because of this, there's no TX lock being held as there's no
1234 	 * encaps state being used.
1235 	 *
1236 	 * Doing a direct parent transmit may not be the correct thing
1237 	 * to do here; we'll have to re-think this soon.
1238 	 */
1239 	IEEE80211_TX_LOCK(ic);
1240 	err = ieee80211_parent_xmitpkt(ic, mcopy);
1241 	IEEE80211_TX_UNLOCK(ic);
1242 	if (!err)
1243 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1244 }
1245 
1246 static struct mbuf *
1247 mesh_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen, int meshdrlen)
1248 {
1249 #define	WHDIR(wh)	((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK)
1250 #define	MC01(mc)	((const struct ieee80211_meshcntl_ae01 *)mc)
1251 	uint8_t b[sizeof(struct ieee80211_qosframe_addr4) +
1252 		  sizeof(struct ieee80211_meshcntl_ae10)];
1253 	const struct ieee80211_qosframe_addr4 *wh;
1254 	const struct ieee80211_meshcntl_ae10 *mc;
1255 	struct ether_header *eh;
1256 	struct llc *llc;
1257 	int ae;
1258 
1259 	if (m->m_len < hdrlen + sizeof(*llc) &&
1260 	    (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
1261 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_ANY,
1262 		    "discard data frame: %s", "m_pullup failed");
1263 		vap->iv_stats.is_rx_tooshort++;
1264 		return NULL;
1265 	}
1266 	memcpy(b, mtod(m, caddr_t), hdrlen);
1267 	wh = (const struct ieee80211_qosframe_addr4 *)&b[0];
1268 	mc = (const struct ieee80211_meshcntl_ae10 *)&b[hdrlen - meshdrlen];
1269 	KASSERT(WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS ||
1270 		WHDIR(wh) == IEEE80211_FC1_DIR_DSTODS,
1271 	    ("bogus dir, fc 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
1272 
1273 	llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
1274 	if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
1275 	    llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
1276 	    llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
1277 	    /* NB: preserve AppleTalk frames that have a native SNAP hdr */
1278 	    !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
1279 	      llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
1280 		m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
1281 		llc = NULL;
1282 	} else {
1283 		m_adj(m, hdrlen - sizeof(*eh));
1284 	}
1285 	eh = mtod(m, struct ether_header *);
1286 	ae = mc->mc_flags & IEEE80211_MESH_AE_MASK;
1287 	if (WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS) {
1288 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr1);
1289 		if (ae == IEEE80211_MESH_AE_00) {
1290 			IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr3);
1291 		} else if (ae == IEEE80211_MESH_AE_01) {
1292 			IEEE80211_ADDR_COPY(eh->ether_shost,
1293 			    MC01(mc)->mc_addr4);
1294 		} else {
1295 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1296 			    (const struct ieee80211_frame *)wh, NULL,
1297 			    "bad AE %d", ae);
1298 			vap->iv_stats.is_mesh_badae++;
1299 			m_freem(m);
1300 			return NULL;
1301 		}
1302 	} else {
1303 		if (ae == IEEE80211_MESH_AE_00) {
1304 			IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr3);
1305 			IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr4);
1306 		} else if (ae == IEEE80211_MESH_AE_10) {
1307 			IEEE80211_ADDR_COPY(eh->ether_dhost, mc->mc_addr5);
1308 			IEEE80211_ADDR_COPY(eh->ether_shost, mc->mc_addr6);
1309 		} else {
1310 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1311 			    (const struct ieee80211_frame *)wh, NULL,
1312 			    "bad AE %d", ae);
1313 			vap->iv_stats.is_mesh_badae++;
1314 			m_freem(m);
1315 			return NULL;
1316 		}
1317 	}
1318 #ifndef __NO_STRICT_ALIGNMENT
1319 	if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
1320 		m = ieee80211_realign(vap, m, sizeof(*eh));
1321 		if (m == NULL)
1322 			return NULL;
1323 	}
1324 #endif /* !__NO_STRICT_ALIGNMENT */
1325 	if (llc != NULL) {
1326 		eh = mtod(m, struct ether_header *);
1327 		eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
1328 	}
1329 	return m;
1330 #undef	WDIR
1331 #undef	MC01
1332 }
1333 
1334 /*
1335  * Return non-zero if the unicast mesh data frame should be processed
1336  * locally.  Frames that are not proxy'd have our address, otherwise
1337  * we need to consult the routing table to look for a proxy entry.
1338  */
1339 static __inline int
1340 mesh_isucastforme(struct ieee80211vap *vap, const struct ieee80211_frame *wh,
1341     const struct ieee80211_meshcntl *mc)
1342 {
1343 	int ae = mc->mc_flags & 3;
1344 
1345 	KASSERT((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS,
1346 	    ("bad dir 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
1347 	KASSERT(ae == IEEE80211_MESH_AE_00 || ae == IEEE80211_MESH_AE_10,
1348 	    ("bad AE %d", ae));
1349 	if (ae == IEEE80211_MESH_AE_10) {	/* ucast w/ proxy */
1350 		const struct ieee80211_meshcntl_ae10 *mc10 =
1351 		    (const struct ieee80211_meshcntl_ae10 *) mc;
1352 		struct ieee80211_mesh_route *rt =
1353 		    ieee80211_mesh_rt_find(vap, mc10->mc_addr5);
1354 		/* check for proxy route to ourself */
1355 		return (rt != NULL &&
1356 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY));
1357 	} else					/* ucast w/o proxy */
1358 		return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
1359 }
1360 
1361 /*
1362  * Verifies transmitter, updates lifetime, precursor list and forwards data.
1363  * > 0 means we have forwarded data and no need to process locally
1364  * == 0 means we want to process locally (and we may have forwarded data
1365  * < 0 means there was an error and data should be discarded
1366  */
1367 static int
1368 mesh_recv_indiv_data_to_fwrd(struct ieee80211vap *vap, struct mbuf *m,
1369     struct ieee80211_frame *wh, const struct ieee80211_meshcntl *mc)
1370 {
1371 	struct ieee80211_qosframe_addr4 *qwh;
1372 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1373 	struct ieee80211_mesh_route *rt_meshda, *rt_meshsa;
1374 
1375 	/* This is called from the RX path - don't hold this lock */
1376 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1377 
1378 	qwh = (struct ieee80211_qosframe_addr4 *)wh;
1379 
1380 	/*
1381 	 * TODO:
1382 	 * o verify addr2 is  a legitimate transmitter
1383 	 * o lifetime of precursor of addr3 (addr2) is max(init, curr)
1384 	 * o lifetime of precursor of addr4 (nexthop) is max(init, curr)
1385 	 */
1386 
1387 	/* set lifetime of addr3 (meshDA) to initial value */
1388 	rt_meshda = ieee80211_mesh_rt_find(vap, qwh->i_addr3);
1389 	if (rt_meshda == NULL) {
1390 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, qwh->i_addr2,
1391 		    "no route to meshDA(%6D)", qwh->i_addr3, ":");
1392 		/*
1393 		 * [Optional] any of the following three actions:
1394 		 * o silently discard 				[X]
1395 		 * o trigger a path discovery			[ ]
1396 		 * o inform TA that meshDA is unknown.		[ ]
1397 		 */
1398 		/* XXX: stats */
1399 		return (-1);
1400 	}
1401 
1402 	ieee80211_mesh_rt_update(rt_meshda, ticks_to_msecs(
1403 	    ms->ms_ppath->mpp_inact));
1404 
1405 	/* set lifetime of addr4 (meshSA) to initial value */
1406 	rt_meshsa = ieee80211_mesh_rt_find(vap, qwh->i_addr4);
1407 	KASSERT(rt_meshsa != NULL, ("no route"));
1408 	ieee80211_mesh_rt_update(rt_meshsa, ticks_to_msecs(
1409 	    ms->ms_ppath->mpp_inact));
1410 
1411 	mesh_forward(vap, m, mc);
1412 	return (1); /* dont process locally */
1413 }
1414 
1415 /*
1416  * Verifies transmitter, updates lifetime, precursor list and process data
1417  * locally, if data is proxy with AE = 10 it could mean data should go
1418  * on another mesh path or data should be forwarded to the DS.
1419  *
1420  * > 0 means we have forwarded data and no need to process locally
1421  * == 0 means we want to process locally (and we may have forwarded data
1422  * < 0 means there was an error and data should be discarded
1423  */
1424 static int
1425 mesh_recv_indiv_data_to_me(struct ieee80211vap *vap, struct mbuf *m,
1426     struct ieee80211_frame *wh, const struct ieee80211_meshcntl *mc)
1427 {
1428 	struct ieee80211_qosframe_addr4 *qwh;
1429 	const struct ieee80211_meshcntl_ae10 *mc10;
1430 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1431 	struct ieee80211_mesh_route *rt;
1432 	int ae;
1433 
1434 	/* This is called from the RX path - don't hold this lock */
1435 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1436 
1437 	qwh = (struct ieee80211_qosframe_addr4 *)wh;
1438 	mc10 = (const struct ieee80211_meshcntl_ae10 *)mc;
1439 
1440 	/*
1441 	 * TODO:
1442 	 * o verify addr2 is  a legitimate transmitter
1443 	 * o lifetime of precursor entry is max(init, curr)
1444 	 */
1445 
1446 	/* set lifetime of addr4 (meshSA) to initial value */
1447 	rt = ieee80211_mesh_rt_find(vap, qwh->i_addr4);
1448 	KASSERT(rt != NULL, ("no route"));
1449 	ieee80211_mesh_rt_update(rt, ticks_to_msecs(ms->ms_ppath->mpp_inact));
1450 	rt = NULL;
1451 
1452 	ae = mc10->mc_flags & IEEE80211_MESH_AE_MASK;
1453 	KASSERT(ae == IEEE80211_MESH_AE_00 ||
1454 	    ae == IEEE80211_MESH_AE_10, ("bad AE %d", ae));
1455 	if (ae == IEEE80211_MESH_AE_10) {
1456 		if (IEEE80211_ADDR_EQ(mc10->mc_addr5, qwh->i_addr3)) {
1457 			return (0); /* process locally */
1458 		}
1459 
1460 		rt =  ieee80211_mesh_rt_find(vap, mc10->mc_addr5);
1461 		if (rt != NULL &&
1462 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) &&
1463 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) == 0) {
1464 			/*
1465 			 * Forward on another mesh-path, according to
1466 			 * amendment as specified in 9.32.4.1
1467 			 */
1468 			IEEE80211_ADDR_COPY(qwh->i_addr3, mc10->mc_addr5);
1469 			mesh_forward(vap, m,
1470 			    (const struct ieee80211_meshcntl *)mc10);
1471 			return (1); /* dont process locally */
1472 		}
1473 		/*
1474 		 * All other cases: forward of MSDUs from the MBSS to DS indiv.
1475 		 * addressed according to 13.11.3.2.
1476 		 */
1477 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_OUTPUT, qwh->i_addr2,
1478 		    "forward frame to DS, SA(%6D) DA(%6D)",
1479 		    mc10->mc_addr6, ":", mc10->mc_addr5, ":");
1480 	}
1481 	return (0); /* process locally */
1482 }
1483 
1484 /*
1485  * Try to forward the group addressed data on to other mesh STAs, and
1486  * also to the DS.
1487  *
1488  * > 0 means we have forwarded data and no need to process locally
1489  * == 0 means we want to process locally (and we may have forwarded data
1490  * < 0 means there was an error and data should be discarded
1491  */
1492 static int
1493 mesh_recv_group_data(struct ieee80211vap *vap, struct mbuf *m,
1494     struct ieee80211_frame *wh, const struct ieee80211_meshcntl *mc)
1495 {
1496 #define	MC01(mc)	((const struct ieee80211_meshcntl_ae01 *)mc)
1497 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1498 
1499 	/* This is called from the RX path - don't hold this lock */
1500 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1501 
1502 	mesh_forward(vap, m, mc);
1503 
1504 	if(mc->mc_ttl > 0) {
1505 		if (mc->mc_flags & IEEE80211_MESH_AE_01) {
1506 			/*
1507 			 * Forward of MSDUs from the MBSS to DS group addressed
1508 			 * (according to 13.11.3.2)
1509 			 * This happens by delivering the packet, and a bridge
1510 			 * will sent it on another port member.
1511 			 */
1512 			if (ms->ms_flags & IEEE80211_MESHFLAGS_GATE &&
1513 			    ms->ms_flags & IEEE80211_MESHFLAGS_FWD)
1514 				IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH,
1515 				    MC01(mc)->mc_addr4, "%s",
1516 				    "forward from MBSS to the DS");
1517 		}
1518 	}
1519 	return (0); /* process locally */
1520 #undef	MC01
1521 }
1522 
1523 static int
1524 mesh_input(struct ieee80211_node *ni, struct mbuf *m,
1525     const struct ieee80211_rx_stats *rxs, int rssi, int nf)
1526 {
1527 #define	HAS_SEQ(type)	((type & 0x4) == 0)
1528 #define	MC01(mc)	((const struct ieee80211_meshcntl_ae01 *)mc)
1529 #define	MC10(mc)	((const struct ieee80211_meshcntl_ae10 *)mc)
1530 	struct ieee80211vap *vap = ni->ni_vap;
1531 	struct ieee80211com *ic = ni->ni_ic;
1532 	struct ifnet *ifp = vap->iv_ifp;
1533 	struct ieee80211_frame *wh;
1534 	const struct ieee80211_meshcntl *mc;
1535 	int hdrspace, meshdrlen, need_tap, error;
1536 	uint8_t dir, type, subtype, ae;
1537 	uint32_t seq;
1538 	const uint8_t *addr;
1539 	uint8_t qos[2];
1540 
1541 	KASSERT(ni != NULL, ("null node"));
1542 	ni->ni_inact = ni->ni_inact_reload;
1543 
1544 	need_tap = 1;			/* mbuf need to be tapped. */
1545 	type = -1;			/* undefined */
1546 
1547 	/* This is called from the RX path - don't hold this lock */
1548 	IEEE80211_TX_UNLOCK_ASSERT(ic);
1549 
1550 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
1551 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1552 		    ni->ni_macaddr, NULL,
1553 		    "too short (1): len %u", m->m_pkthdr.len);
1554 		vap->iv_stats.is_rx_tooshort++;
1555 		goto out;
1556 	}
1557 	/*
1558 	 * Bit of a cheat here, we use a pointer for a 3-address
1559 	 * frame format but don't reference fields past outside
1560 	 * ieee80211_frame_min w/o first validating the data is
1561 	 * present.
1562 	*/
1563 	wh = mtod(m, struct ieee80211_frame *);
1564 
1565 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
1566 	    IEEE80211_FC0_VERSION_0) {
1567 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1568 		    ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
1569 		vap->iv_stats.is_rx_badversion++;
1570 		goto err;
1571 	}
1572 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
1573 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1574 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1575 	if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1576 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
1577 		ni->ni_noise = nf;
1578 		if (HAS_SEQ(type)) {
1579 			uint8_t tid = ieee80211_gettid(wh);
1580 
1581 			if (IEEE80211_QOS_HAS_SEQ(wh) &&
1582 			    TID_TO_WME_AC(tid) >= WME_AC_VI)
1583 				ic->ic_wme.wme_hipri_traffic++;
1584 			if (! ieee80211_check_rxseq(ni, wh, wh->i_addr1))
1585 				goto out;
1586 		}
1587 	}
1588 #ifdef IEEE80211_DEBUG
1589 	/*
1590 	 * It's easier, but too expensive, to simulate different mesh
1591 	 * topologies by consulting the ACL policy very early, so do this
1592 	 * only under DEBUG.
1593 	 *
1594 	 * NB: this check is also done upon peering link initiation.
1595 	 */
1596 	if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1597 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1598 		    wh, NULL, "%s", "disallowed by ACL");
1599 		vap->iv_stats.is_rx_acl++;
1600 		goto out;
1601 	}
1602 #endif
1603 	switch (type) {
1604 	case IEEE80211_FC0_TYPE_DATA:
1605 		if (ni == vap->iv_bss)
1606 			goto out;
1607 		if (ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
1608 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
1609 			    ni->ni_macaddr, NULL,
1610 			    "peer link not yet established (%d)",
1611 			    ni->ni_mlstate);
1612 			vap->iv_stats.is_mesh_nolink++;
1613 			goto out;
1614 		}
1615 		if (dir != IEEE80211_FC1_DIR_FROMDS &&
1616 		    dir != IEEE80211_FC1_DIR_DSTODS) {
1617 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1618 			    wh, "data", "incorrect dir 0x%x", dir);
1619 			vap->iv_stats.is_rx_wrongdir++;
1620 			goto err;
1621 		}
1622 
1623 		/* All Mesh data frames are QoS subtype */
1624 		if (!HAS_SEQ(type)) {
1625 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1626 			    wh, "data", "incorrect subtype 0x%x", subtype);
1627 			vap->iv_stats.is_rx_badsubtype++;
1628 			goto err;
1629 		}
1630 
1631 		/*
1632 		 * Next up, any fragmentation.
1633 		 * XXX: we defrag before we even try to forward,
1634 		 * Mesh Control field is not present in sub-sequent
1635 		 * fragmented frames. This is in contrast to Draft 4.0.
1636 		 */
1637 		hdrspace = ieee80211_hdrspace(ic, wh);
1638 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1639 			m = ieee80211_defrag(ni, m, hdrspace);
1640 			if (m == NULL) {
1641 				/* Fragment dropped or frame not complete yet */
1642 				goto out;
1643 			}
1644 		}
1645 		wh = mtod(m, struct ieee80211_frame *); /* NB: after defrag */
1646 
1647 		/*
1648 		 * Now we have a complete Mesh Data frame.
1649 		 */
1650 
1651 		/*
1652 		 * Only fromDStoDS data frames use 4 address qos frames
1653 		 * as specified in amendment. Otherwise addr4 is located
1654 		 * in the Mesh Control field and a 3 address qos frame
1655 		 * is used.
1656 		 */
1657 		if (IEEE80211_IS_DSTODS(wh))
1658 			*(uint16_t *)qos = *(uint16_t *)
1659 			    ((struct ieee80211_qosframe_addr4 *)wh)->i_qos;
1660 		else
1661 			*(uint16_t *)qos = *(uint16_t *)
1662 			    ((struct ieee80211_qosframe *)wh)->i_qos;
1663 
1664 		/*
1665 		 * NB: The mesh STA sets the Mesh Control Present
1666 		 * subfield to 1 in the Mesh Data frame containing
1667 		 * an unfragmented MSDU, an A-MSDU, or the first
1668 		 * fragment of an MSDU.
1669 		 * After defrag it should always be present.
1670 		 */
1671 		if (!(qos[1] & IEEE80211_QOS_MC)) {
1672 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
1673 			    ni->ni_macaddr, NULL,
1674 			    "%s", "Mesh control field not present");
1675 			vap->iv_stats.is_rx_elem_missing++; /* XXX: kinda */
1676 			goto err;
1677 		}
1678 
1679 		/* pull up enough to get to the mesh control */
1680 		if (m->m_len < hdrspace + sizeof(struct ieee80211_meshcntl) &&
1681 		    (m = m_pullup(m, hdrspace +
1682 		        sizeof(struct ieee80211_meshcntl))) == NULL) {
1683 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1684 			    ni->ni_macaddr, NULL,
1685 			    "data too short: expecting %u", hdrspace);
1686 			vap->iv_stats.is_rx_tooshort++;
1687 			goto out;		/* XXX */
1688 		}
1689 		/*
1690 		 * Now calculate the full extent of the headers. Note
1691 		 * mesh_decap will pull up anything we didn't get
1692 		 * above when it strips the 802.11 headers.
1693 		 */
1694 		mc = (const struct ieee80211_meshcntl *)
1695 		    (mtod(m, const uint8_t *) + hdrspace);
1696 		ae = mc->mc_flags & IEEE80211_MESH_AE_MASK;
1697 		meshdrlen = sizeof(struct ieee80211_meshcntl) +
1698 		    ae * IEEE80211_ADDR_LEN;
1699 		hdrspace += meshdrlen;
1700 
1701 		/* pull complete hdrspace = ieee80211_hdrspace + meshcontrol */
1702 		if ((meshdrlen > sizeof(struct ieee80211_meshcntl)) &&
1703 		    (m->m_len < hdrspace) &&
1704 		    ((m = m_pullup(m, hdrspace)) == NULL)) {
1705 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1706 			    ni->ni_macaddr, NULL,
1707 			    "data too short: expecting %u", hdrspace);
1708 			vap->iv_stats.is_rx_tooshort++;
1709 			goto out;		/* XXX */
1710 		}
1711 		/* XXX: are we sure there is no reallocating after m_pullup? */
1712 
1713 		seq = LE_READ_4(mc->mc_seq);
1714 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1715 			addr = wh->i_addr3;
1716 		else if (ae == IEEE80211_MESH_AE_01)
1717 			addr = MC01(mc)->mc_addr4;
1718 		else
1719 			addr = ((struct ieee80211_qosframe_addr4 *)wh)->i_addr4;
1720 		if (IEEE80211_ADDR_EQ(vap->iv_myaddr, addr)) {
1721 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1722 			    addr, "data", "%s", "not to me");
1723 			vap->iv_stats.is_rx_wrongbss++;	/* XXX kinda */
1724 			goto out;
1725 		}
1726 		if (mesh_checkpseq(vap, addr, seq) != 0) {
1727 			vap->iv_stats.is_rx_dup++;
1728 			goto out;
1729 		}
1730 
1731 		/* This code "routes" the frame to the right control path */
1732 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1733 			if (IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr3))
1734 				error =
1735 				    mesh_recv_indiv_data_to_me(vap, m, wh, mc);
1736 			else if (IEEE80211_IS_MULTICAST(wh->i_addr3))
1737 				error = mesh_recv_group_data(vap, m, wh, mc);
1738 			else
1739 				error = mesh_recv_indiv_data_to_fwrd(vap, m,
1740 				    wh, mc);
1741 		} else
1742 			error = mesh_recv_group_data(vap, m, wh, mc);
1743 		if (error < 0)
1744 			goto err;
1745 		else if (error > 0)
1746 			goto out;
1747 
1748 		if (ieee80211_radiotap_active_vap(vap))
1749 			ieee80211_radiotap_rx(vap, m);
1750 		need_tap = 0;
1751 
1752 		/*
1753 		 * Finally, strip the 802.11 header.
1754 		 */
1755 		m = mesh_decap(vap, m, hdrspace, meshdrlen);
1756 		if (m == NULL) {
1757 			/* XXX mask bit to check for both */
1758 			/* don't count Null data frames as errors */
1759 			if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
1760 			    subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
1761 				goto out;
1762 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1763 			    ni->ni_macaddr, "data", "%s", "decap error");
1764 			vap->iv_stats.is_rx_decap++;
1765 			IEEE80211_NODE_STAT(ni, rx_decap);
1766 			goto err;
1767 		}
1768 		if (qos[0] & IEEE80211_QOS_AMSDU) {
1769 			m = ieee80211_decap_amsdu(ni, m);
1770 			if (m == NULL)
1771 				return IEEE80211_FC0_TYPE_DATA;
1772 		}
1773 		ieee80211_deliver_data(vap, ni, m);
1774 		return type;
1775 	case IEEE80211_FC0_TYPE_MGT:
1776 		vap->iv_stats.is_rx_mgmt++;
1777 		IEEE80211_NODE_STAT(ni, rx_mgmt);
1778 		if (dir != IEEE80211_FC1_DIR_NODS) {
1779 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1780 			    wh, "mgt", "incorrect dir 0x%x", dir);
1781 			vap->iv_stats.is_rx_wrongdir++;
1782 			goto err;
1783 		}
1784 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
1785 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1786 			    ni->ni_macaddr, "mgt", "too short: len %u",
1787 			    m->m_pkthdr.len);
1788 			vap->iv_stats.is_rx_tooshort++;
1789 			goto out;
1790 		}
1791 #ifdef IEEE80211_DEBUG
1792 		if ((ieee80211_msg_debug(vap) &&
1793 		    (vap->iv_ic->ic_flags & IEEE80211_F_SCAN)) ||
1794 		    ieee80211_msg_dumppkts(vap)) {
1795 			if_printf(ifp, "received %s from %s rssi %d\n",
1796 			    ieee80211_mgt_subtype_name[subtype >>
1797 			    IEEE80211_FC0_SUBTYPE_SHIFT],
1798 			    ether_sprintf(wh->i_addr2), rssi);
1799 		}
1800 #endif
1801 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1802 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1803 			    wh, NULL, "%s", "WEP set but not permitted");
1804 			vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
1805 			goto out;
1806 		}
1807 		vap->iv_recv_mgmt(ni, m, subtype, rxs, rssi, nf);
1808 		goto out;
1809 	case IEEE80211_FC0_TYPE_CTL:
1810 		vap->iv_stats.is_rx_ctl++;
1811 		IEEE80211_NODE_STAT(ni, rx_ctrl);
1812 		goto out;
1813 	default:
1814 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1815 		    wh, "bad", "frame type 0x%x", type);
1816 		/* should not come here */
1817 		break;
1818 	}
1819 err:
1820 	if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1821 out:
1822 	if (m != NULL) {
1823 		if (need_tap && ieee80211_radiotap_active_vap(vap))
1824 			ieee80211_radiotap_rx(vap, m);
1825 		m_freem(m);
1826 	}
1827 	return type;
1828 #undef	HAS_SEQ
1829 #undef	MC01
1830 #undef	MC10
1831 }
1832 
1833 static void
1834 mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
1835     const struct ieee80211_rx_stats *rxs, int rssi, int nf)
1836 {
1837 	struct ieee80211vap *vap = ni->ni_vap;
1838 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1839 	struct ieee80211com *ic = ni->ni_ic;
1840 	struct ieee80211_channel *rxchan = ic->ic_curchan;
1841 	struct ieee80211_frame *wh;
1842 	struct ieee80211_mesh_route *rt;
1843 	uint8_t *frm, *efrm;
1844 
1845 	wh = mtod(m0, struct ieee80211_frame *);
1846 	frm = (uint8_t *)&wh[1];
1847 	efrm = mtod(m0, uint8_t *) + m0->m_len;
1848 	switch (subtype) {
1849 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1850 	case IEEE80211_FC0_SUBTYPE_BEACON:
1851 	{
1852 		struct ieee80211_scanparams scan;
1853 		struct ieee80211_channel *c;
1854 		/*
1855 		 * We process beacon/probe response
1856 		 * frames to discover neighbors.
1857 		 */
1858 		if (rxs != NULL) {
1859 			c = ieee80211_lookup_channel_rxstatus(vap, rxs);
1860 			if (c != NULL)
1861 				rxchan = c;
1862 		}
1863 		if (ieee80211_parse_beacon(ni, m0, rxchan, &scan) != 0)
1864 			return;
1865 		/*
1866 		 * Count frame now that we know it's to be processed.
1867 		 */
1868 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1869 			vap->iv_stats.is_rx_beacon++;	/* XXX remove */
1870 			IEEE80211_NODE_STAT(ni, rx_beacons);
1871 		} else
1872 			IEEE80211_NODE_STAT(ni, rx_proberesp);
1873 		/*
1874 		 * If scanning, just pass information to the scan module.
1875 		 */
1876 		if (ic->ic_flags & IEEE80211_F_SCAN) {
1877 			if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1878 				/*
1879 				 * Actively scanning a channel marked passive;
1880 				 * send a probe request now that we know there
1881 				 * is 802.11 traffic present.
1882 				 *
1883 				 * XXX check if the beacon we recv'd gives
1884 				 * us what we need and suppress the probe req
1885 				 */
1886 				ieee80211_probe_curchan(vap, 1);
1887 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1888 			}
1889 			ieee80211_add_scan(vap, rxchan, &scan, wh,
1890 			    subtype, rssi, nf);
1891 			return;
1892 		}
1893 
1894 		/* The rest of this code assumes we are running */
1895 		if (vap->iv_state != IEEE80211_S_RUN)
1896 			return;
1897 		/*
1898 		 * Ignore non-mesh STAs.
1899 		 */
1900 		if ((scan.capinfo &
1901 		     (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) ||
1902 		    scan.meshid == NULL || scan.meshconf == NULL) {
1903 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1904 			    wh, "beacon", "%s", "not a mesh sta");
1905 			vap->iv_stats.is_mesh_wrongmesh++;
1906 			return;
1907 		}
1908 		/*
1909 		 * Ignore STAs for other mesh networks.
1910 		 */
1911 		if (memcmp(scan.meshid+2, ms->ms_id, ms->ms_idlen) != 0 ||
1912 		    mesh_verify_meshconf(vap, scan.meshconf)) {
1913 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1914 			    wh, "beacon", "%s", "not for our mesh");
1915 			vap->iv_stats.is_mesh_wrongmesh++;
1916 			return;
1917 		}
1918 		/*
1919 		 * Peer only based on the current ACL policy.
1920 		 */
1921 		if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1922 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1923 			    wh, NULL, "%s", "disallowed by ACL");
1924 			vap->iv_stats.is_rx_acl++;
1925 			return;
1926 		}
1927 		/*
1928 		 * Do neighbor discovery.
1929 		 */
1930 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
1931 			/*
1932 			 * Create a new entry in the neighbor table.
1933 			 */
1934 			ni = ieee80211_add_neighbor(vap, wh, &scan);
1935 		}
1936 		/*
1937 		 * Automatically peer with discovered nodes if possible.
1938 		 */
1939 		if (ni != vap->iv_bss &&
1940 		    (ms->ms_flags & IEEE80211_MESHFLAGS_AP)) {
1941 			switch (ni->ni_mlstate) {
1942 			case IEEE80211_NODE_MESH_IDLE:
1943 			{
1944 				uint16_t args[1];
1945 
1946 				/* Wait for backoff callout to reset counter */
1947 				if (ni->ni_mlhcnt >= ieee80211_mesh_maxholding)
1948 					return;
1949 
1950 				ni->ni_mlpid = mesh_generateid(vap);
1951 				if (ni->ni_mlpid == 0)
1952 					return;
1953 				mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENSNT);
1954 				args[0] = ni->ni_mlpid;
1955 				ieee80211_send_action(ni,
1956 				IEEE80211_ACTION_CAT_SELF_PROT,
1957 				IEEE80211_ACTION_MESHPEERING_OPEN, args);
1958 				ni->ni_mlrcnt = 0;
1959 				mesh_peer_timeout_setup(ni);
1960 				break;
1961 			}
1962 			case IEEE80211_NODE_MESH_ESTABLISHED:
1963 			{
1964 				/*
1965 				 * Valid beacon from a peer mesh STA
1966 				 * bump TA lifetime
1967 				 */
1968 				rt = ieee80211_mesh_rt_find(vap, wh->i_addr2);
1969 				if(rt != NULL) {
1970 					ieee80211_mesh_rt_update(rt,
1971 					    ticks_to_msecs(
1972 					    ms->ms_ppath->mpp_inact));
1973 				}
1974 				break;
1975 			}
1976 			default:
1977 				break; /* ignore */
1978 			}
1979 		}
1980 		break;
1981 	}
1982 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1983 	{
1984 		uint8_t *ssid, *meshid, *rates, *xrates;
1985 		uint8_t *sfrm;
1986 
1987 		if (vap->iv_state != IEEE80211_S_RUN) {
1988 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1989 			    wh, NULL, "wrong state %s",
1990 			    ieee80211_state_name[vap->iv_state]);
1991 			vap->iv_stats.is_rx_mgtdiscard++;
1992 			return;
1993 		}
1994 		if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
1995 			/* frame must be directed */
1996 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1997 			    wh, NULL, "%s", "not unicast");
1998 			vap->iv_stats.is_rx_mgtdiscard++;	/* XXX stat */
1999 			return;
2000 		}
2001 		/*
2002 		 * prreq frame format
2003 		 *      [tlv] ssid
2004 		 *      [tlv] supported rates
2005 		 *      [tlv] extended supported rates
2006 		 *	[tlv] mesh id
2007 		 */
2008 		ssid = meshid = rates = xrates = NULL;
2009 		sfrm = frm;
2010 		while (efrm - frm > 1) {
2011 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
2012 			switch (*frm) {
2013 			case IEEE80211_ELEMID_SSID:
2014 				ssid = frm;
2015 				break;
2016 			case IEEE80211_ELEMID_RATES:
2017 				rates = frm;
2018 				break;
2019 			case IEEE80211_ELEMID_XRATES:
2020 				xrates = frm;
2021 				break;
2022 			case IEEE80211_ELEMID_MESHID:
2023 				meshid = frm;
2024 				break;
2025 			}
2026 			frm += frm[1] + 2;
2027 		}
2028 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
2029 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
2030 		if (xrates != NULL)
2031 			IEEE80211_VERIFY_ELEMENT(xrates,
2032 			    IEEE80211_RATE_MAXSIZE - rates[1], return);
2033 		if (meshid != NULL) {
2034 			IEEE80211_VERIFY_ELEMENT(meshid,
2035 			    IEEE80211_MESHID_LEN, return);
2036 			/* NB: meshid, not ssid */
2037 			IEEE80211_VERIFY_SSID(vap->iv_bss, meshid, return);
2038 		}
2039 
2040 		/* XXX find a better class or define it's own */
2041 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
2042 		    "%s", "recv probe req");
2043 		/*
2044 		 * Some legacy 11b clients cannot hack a complete
2045 		 * probe response frame.  When the request includes
2046 		 * only a bare-bones rate set, communicate this to
2047 		 * the transmit side.
2048 		 */
2049 		ieee80211_send_proberesp(vap, wh->i_addr2, 0);
2050 		break;
2051 	}
2052 
2053 	case IEEE80211_FC0_SUBTYPE_ACTION:
2054 	case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
2055 		if (ni == vap->iv_bss) {
2056 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2057 			    wh, NULL, "%s", "unknown node");
2058 			vap->iv_stats.is_rx_mgtdiscard++;
2059 		} else if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
2060 		    !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2061 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2062 			    wh, NULL, "%s", "not for us");
2063 			vap->iv_stats.is_rx_mgtdiscard++;
2064 		} else if (vap->iv_state != IEEE80211_S_RUN) {
2065 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2066 			    wh, NULL, "wrong state %s",
2067 			    ieee80211_state_name[vap->iv_state]);
2068 			vap->iv_stats.is_rx_mgtdiscard++;
2069 		} else {
2070 			if (ieee80211_parse_action(ni, m0) == 0)
2071 				(void)ic->ic_recv_action(ni, wh, frm, efrm);
2072 		}
2073 		break;
2074 
2075 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2076 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2077 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
2078 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2079 	case IEEE80211_FC0_SUBTYPE_TIMING_ADV:
2080 	case IEEE80211_FC0_SUBTYPE_ATIM:
2081 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
2082 	case IEEE80211_FC0_SUBTYPE_AUTH:
2083 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
2084 		IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2085 		    wh, NULL, "%s", "not handled");
2086 		vap->iv_stats.is_rx_mgtdiscard++;
2087 		break;
2088 
2089 	default:
2090 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
2091 		    wh, "mgt", "subtype 0x%x not handled", subtype);
2092 		vap->iv_stats.is_rx_badsubtype++;
2093 		break;
2094 	}
2095 }
2096 
2097 static void
2098 mesh_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
2099 {
2100 
2101 	switch (subtype) {
2102 	case IEEE80211_FC0_SUBTYPE_BAR:
2103 		ieee80211_recv_bar(ni, m);
2104 		break;
2105 	}
2106 }
2107 
2108 /*
2109  * Parse meshpeering action ie's for MPM frames
2110  */
2111 static const struct ieee80211_meshpeer_ie *
2112 mesh_parse_meshpeering_action(struct ieee80211_node *ni,
2113 	const struct ieee80211_frame *wh,	/* XXX for VERIFY_LENGTH */
2114 	const uint8_t *frm, const uint8_t *efrm,
2115 	struct ieee80211_meshpeer_ie *mp, uint8_t subtype)
2116 {
2117 	struct ieee80211vap *vap = ni->ni_vap;
2118 	const struct ieee80211_meshpeer_ie *mpie;
2119 	uint16_t args[3];
2120 	const uint8_t *meshid, *meshconf, *meshpeer;
2121 	uint8_t sendclose = 0; /* 1 = MPM frame rejected, close will be sent */
2122 
2123 	meshid = meshconf = meshpeer = NULL;
2124 	while (efrm - frm > 1) {
2125 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return NULL);
2126 		switch (*frm) {
2127 		case IEEE80211_ELEMID_MESHID:
2128 			meshid = frm;
2129 			break;
2130 		case IEEE80211_ELEMID_MESHCONF:
2131 			meshconf = frm;
2132 			break;
2133 		case IEEE80211_ELEMID_MESHPEER:
2134 			meshpeer = frm;
2135 			mpie = (const struct ieee80211_meshpeer_ie *) frm;
2136 			memset(mp, 0, sizeof(*mp));
2137 			mp->peer_len = mpie->peer_len;
2138 			mp->peer_proto = LE_READ_2(&mpie->peer_proto);
2139 			mp->peer_llinkid = LE_READ_2(&mpie->peer_llinkid);
2140 			switch (subtype) {
2141 			case IEEE80211_ACTION_MESHPEERING_CONFIRM:
2142 				mp->peer_linkid =
2143 				    LE_READ_2(&mpie->peer_linkid);
2144 				break;
2145 			case IEEE80211_ACTION_MESHPEERING_CLOSE:
2146 				/* NB: peer link ID is optional */
2147 				if (mpie->peer_len ==
2148 				    (IEEE80211_MPM_BASE_SZ + 2)) {
2149 					mp->peer_linkid = 0;
2150 					mp->peer_rcode =
2151 					    LE_READ_2(&mpie->peer_linkid);
2152 				} else {
2153 					mp->peer_linkid =
2154 					    LE_READ_2(&mpie->peer_linkid);
2155 					mp->peer_rcode =
2156 					    LE_READ_2(&mpie->peer_rcode);
2157 				}
2158 				break;
2159 			}
2160 			break;
2161 		}
2162 		frm += frm[1] + 2;
2163 	}
2164 
2165 	/*
2166 	 * Verify the contents of the frame.
2167 	 * If it fails validation, close the peer link.
2168 	 */
2169 	if (mesh_verify_meshpeer(vap, subtype, (const uint8_t *)mp)) {
2170 		sendclose = 1;
2171 		IEEE80211_DISCARD(vap,
2172 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2173 		    wh, NULL, "%s", "MPM validation failed");
2174 	}
2175 
2176 	/* If meshid is not the same reject any frames type. */
2177 	if (sendclose == 0 && mesh_verify_meshid(vap, meshid)) {
2178 		sendclose = 1;
2179 		IEEE80211_DISCARD(vap,
2180 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2181 		    wh, NULL, "%s", "not for our mesh");
2182 		if (subtype == IEEE80211_ACTION_MESHPEERING_CLOSE) {
2183 			/*
2184 			 * Standard not clear about this, if we dont ignore
2185 			 * there will be an endless loop between nodes sending
2186 			 * CLOSE frames between each other with wrong meshid.
2187 			 * Discard and timers will bring FSM to IDLE state.
2188 			 */
2189 			return NULL;
2190 		}
2191 	}
2192 
2193 	/*
2194 	 * Close frames are accepted if meshid is the same.
2195 	 * Verify the other two types.
2196 	 */
2197 	if (sendclose == 0 && subtype != IEEE80211_ACTION_MESHPEERING_CLOSE &&
2198 	    mesh_verify_meshconf(vap, meshconf)) {
2199 		sendclose = 1;
2200 		IEEE80211_DISCARD(vap,
2201 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2202 		    wh, NULL, "%s", "configuration missmatch");
2203 	}
2204 
2205 	if (sendclose) {
2206 		vap->iv_stats.is_rx_mgtdiscard++;
2207 		switch (ni->ni_mlstate) {
2208 		case IEEE80211_NODE_MESH_IDLE:
2209 		case IEEE80211_NODE_MESH_ESTABLISHED:
2210 		case IEEE80211_NODE_MESH_HOLDING:
2211 			/* ignore */
2212 			break;
2213 		case IEEE80211_NODE_MESH_OPENSNT:
2214 		case IEEE80211_NODE_MESH_OPENRCV:
2215 		case IEEE80211_NODE_MESH_CONFIRMRCV:
2216 			args[0] = ni->ni_mlpid;
2217 			args[1] = ni->ni_mllid;
2218 			/* Reason codes for rejection */
2219 			switch (subtype) {
2220 			case IEEE80211_ACTION_MESHPEERING_OPEN:
2221 				args[2] = IEEE80211_REASON_MESH_CPVIOLATION;
2222 				break;
2223 			case IEEE80211_ACTION_MESHPEERING_CONFIRM:
2224 				args[2] = IEEE80211_REASON_MESH_INCONS_PARAMS;
2225 				break;
2226 			}
2227 			ieee80211_send_action(ni,
2228 			    IEEE80211_ACTION_CAT_SELF_PROT,
2229 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2230 			    args);
2231 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2232 			mesh_peer_timeout_setup(ni);
2233 			break;
2234 		}
2235 		return NULL;
2236 	}
2237 
2238 	return (const struct ieee80211_meshpeer_ie *) mp;
2239 }
2240 
2241 static int
2242 mesh_recv_action_meshpeering_open(struct ieee80211_node *ni,
2243 	const struct ieee80211_frame *wh,
2244 	const uint8_t *frm, const uint8_t *efrm)
2245 {
2246 	struct ieee80211vap *vap = ni->ni_vap;
2247 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
2248 	struct ieee80211_meshpeer_ie ie;
2249 	const struct ieee80211_meshpeer_ie *meshpeer;
2250 	uint16_t args[3];
2251 
2252 	/* +2+2 for action + code + capabilites */
2253 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2, efrm, &ie,
2254 	    IEEE80211_ACTION_MESHPEERING_OPEN);
2255 	if (meshpeer == NULL) {
2256 		return 0;
2257 	}
2258 
2259 	/* XXX move up */
2260 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2261 	    "recv PEER OPEN, lid 0x%x", meshpeer->peer_llinkid);
2262 
2263 	switch (ni->ni_mlstate) {
2264 	case IEEE80211_NODE_MESH_IDLE:
2265 		/* Reject open request if reached our maximum neighbor count */
2266 		if (ms->ms_neighbors >= IEEE80211_MESH_MAX_NEIGHBORS) {
2267 			args[0] = meshpeer->peer_llinkid;
2268 			args[1] = 0;
2269 			args[2] = IEEE80211_REASON_MESH_MAX_PEERS;
2270 			ieee80211_send_action(ni,
2271 			    IEEE80211_ACTION_CAT_SELF_PROT,
2272 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2273 			    args);
2274 			/* stay in IDLE state */
2275 			return (0);
2276 		}
2277 		/* Open frame accepted */
2278 		mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
2279 		ni->ni_mllid = meshpeer->peer_llinkid;
2280 		ni->ni_mlpid = mesh_generateid(vap);
2281 		if (ni->ni_mlpid == 0)
2282 			return 0;		/* XXX */
2283 		args[0] = ni->ni_mlpid;
2284 		/* Announce we're open too... */
2285 		ieee80211_send_action(ni,
2286 		    IEEE80211_ACTION_CAT_SELF_PROT,
2287 		    IEEE80211_ACTION_MESHPEERING_OPEN, args);
2288 		/* ...and confirm the link. */
2289 		args[0] = ni->ni_mlpid;
2290 		args[1] = ni->ni_mllid;
2291 		ieee80211_send_action(ni,
2292 		    IEEE80211_ACTION_CAT_SELF_PROT,
2293 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2294 		    args);
2295 		mesh_peer_timeout_setup(ni);
2296 		break;
2297 	case IEEE80211_NODE_MESH_OPENRCV:
2298 		/* Wrong Link ID */
2299 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
2300 			args[0] = ni->ni_mllid;
2301 			args[1] = ni->ni_mlpid;
2302 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2303 			ieee80211_send_action(ni,
2304 			    IEEE80211_ACTION_CAT_SELF_PROT,
2305 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2306 			    args);
2307 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2308 			mesh_peer_timeout_setup(ni);
2309 			break;
2310 		}
2311 		/* Duplicate open, confirm again. */
2312 		args[0] = ni->ni_mlpid;
2313 		args[1] = ni->ni_mllid;
2314 		ieee80211_send_action(ni,
2315 		    IEEE80211_ACTION_CAT_SELF_PROT,
2316 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2317 		    args);
2318 		break;
2319 	case IEEE80211_NODE_MESH_OPENSNT:
2320 		ni->ni_mllid = meshpeer->peer_llinkid;
2321 		mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
2322 		args[0] = ni->ni_mlpid;
2323 		args[1] = ni->ni_mllid;
2324 		ieee80211_send_action(ni,
2325 		    IEEE80211_ACTION_CAT_SELF_PROT,
2326 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2327 		    args);
2328 		/* NB: don't setup/clear any timeout */
2329 		break;
2330 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2331 		if (ni->ni_mlpid != meshpeer->peer_linkid ||
2332 		    ni->ni_mllid != meshpeer->peer_llinkid) {
2333 			args[0] = ni->ni_mlpid;
2334 			args[1] = ni->ni_mllid;
2335 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2336 			ieee80211_send_action(ni,
2337 			    IEEE80211_ACTION_CAT_SELF_PROT,
2338 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2339 			    args);
2340 			mesh_linkchange(ni,
2341 			    IEEE80211_NODE_MESH_HOLDING);
2342 			mesh_peer_timeout_setup(ni);
2343 			break;
2344 		}
2345 		mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
2346 		ni->ni_mllid = meshpeer->peer_llinkid;
2347 		args[0] = ni->ni_mlpid;
2348 		args[1] = ni->ni_mllid;
2349 		ieee80211_send_action(ni,
2350 		    IEEE80211_ACTION_CAT_SELF_PROT,
2351 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2352 		    args);
2353 		mesh_peer_timeout_stop(ni);
2354 		break;
2355 	case IEEE80211_NODE_MESH_ESTABLISHED:
2356 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
2357 			args[0] = ni->ni_mllid;
2358 			args[1] = ni->ni_mlpid;
2359 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2360 			ieee80211_send_action(ni,
2361 			    IEEE80211_ACTION_CAT_SELF_PROT,
2362 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2363 			    args);
2364 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2365 			mesh_peer_timeout_setup(ni);
2366 			break;
2367 		}
2368 		args[0] = ni->ni_mlpid;
2369 		args[1] = ni->ni_mllid;
2370 		ieee80211_send_action(ni,
2371 		    IEEE80211_ACTION_CAT_SELF_PROT,
2372 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2373 		    args);
2374 		break;
2375 	case IEEE80211_NODE_MESH_HOLDING:
2376 		args[0] = ni->ni_mlpid;
2377 		args[1] = meshpeer->peer_llinkid;
2378 		/* Standard not clear about what the reaason code should be */
2379 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2380 		ieee80211_send_action(ni,
2381 		    IEEE80211_ACTION_CAT_SELF_PROT,
2382 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2383 		    args);
2384 		break;
2385 	}
2386 	return 0;
2387 }
2388 
2389 static int
2390 mesh_recv_action_meshpeering_confirm(struct ieee80211_node *ni,
2391 	const struct ieee80211_frame *wh,
2392 	const uint8_t *frm, const uint8_t *efrm)
2393 {
2394 	struct ieee80211vap *vap = ni->ni_vap;
2395 	struct ieee80211_meshpeer_ie ie;
2396 	const struct ieee80211_meshpeer_ie *meshpeer;
2397 	uint16_t args[3];
2398 
2399 	/* +2+2+2+2 for action + code + capabilites + status code + AID */
2400 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2+2+2, efrm, &ie,
2401 	    IEEE80211_ACTION_MESHPEERING_CONFIRM);
2402 	if (meshpeer == NULL) {
2403 		return 0;
2404 	}
2405 
2406 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2407 	    "recv PEER CONFIRM, local id 0x%x, peer id 0x%x",
2408 	    meshpeer->peer_llinkid, meshpeer->peer_linkid);
2409 
2410 	switch (ni->ni_mlstate) {
2411 	case IEEE80211_NODE_MESH_OPENRCV:
2412 		mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
2413 		mesh_peer_timeout_stop(ni);
2414 		break;
2415 	case IEEE80211_NODE_MESH_OPENSNT:
2416 		mesh_linkchange(ni, IEEE80211_NODE_MESH_CONFIRMRCV);
2417 		mesh_peer_timeout_setup(ni);
2418 		break;
2419 	case IEEE80211_NODE_MESH_HOLDING:
2420 		args[0] = ni->ni_mlpid;
2421 		args[1] = meshpeer->peer_llinkid;
2422 		/* Standard not clear about what the reaason code should be */
2423 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2424 		ieee80211_send_action(ni,
2425 		    IEEE80211_ACTION_CAT_SELF_PROT,
2426 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2427 		    args);
2428 		break;
2429 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2430 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
2431 			args[0] = ni->ni_mlpid;
2432 			args[1] = ni->ni_mllid;
2433 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2434 			ieee80211_send_action(ni,
2435 			    IEEE80211_ACTION_CAT_SELF_PROT,
2436 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2437 			    args);
2438 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2439 			mesh_peer_timeout_setup(ni);
2440 		}
2441 		break;
2442 	default:
2443 		IEEE80211_DISCARD(vap,
2444 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2445 		    wh, NULL, "received confirm in invalid state %d",
2446 		    ni->ni_mlstate);
2447 		vap->iv_stats.is_rx_mgtdiscard++;
2448 		break;
2449 	}
2450 	return 0;
2451 }
2452 
2453 static int
2454 mesh_recv_action_meshpeering_close(struct ieee80211_node *ni,
2455 	const struct ieee80211_frame *wh,
2456 	const uint8_t *frm, const uint8_t *efrm)
2457 {
2458 	struct ieee80211_meshpeer_ie ie;
2459 	const struct ieee80211_meshpeer_ie *meshpeer;
2460 	uint16_t args[3];
2461 
2462 	/* +2 for action + code */
2463 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2, efrm, &ie,
2464 	    IEEE80211_ACTION_MESHPEERING_CLOSE);
2465 	if (meshpeer == NULL) {
2466 		return 0;
2467 	}
2468 
2469 	/*
2470 	 * XXX: check reason code, for example we could receive
2471 	 * IEEE80211_REASON_MESH_MAX_PEERS then we should not attempt
2472 	 * to peer again.
2473 	 */
2474 
2475 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2476 	    ni, "%s", "recv PEER CLOSE");
2477 
2478 	switch (ni->ni_mlstate) {
2479 	case IEEE80211_NODE_MESH_IDLE:
2480 		/* ignore */
2481 		break;
2482 	case IEEE80211_NODE_MESH_OPENRCV:
2483 	case IEEE80211_NODE_MESH_OPENSNT:
2484 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2485 	case IEEE80211_NODE_MESH_ESTABLISHED:
2486 		args[0] = ni->ni_mlpid;
2487 		args[1] = ni->ni_mllid;
2488 		args[2] = IEEE80211_REASON_MESH_CLOSE_RCVD;
2489 		ieee80211_send_action(ni,
2490 		    IEEE80211_ACTION_CAT_SELF_PROT,
2491 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2492 		    args);
2493 		mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2494 		mesh_peer_timeout_setup(ni);
2495 		break;
2496 	case IEEE80211_NODE_MESH_HOLDING:
2497 		mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
2498 		mesh_peer_timeout_stop(ni);
2499 		break;
2500 	}
2501 	return 0;
2502 }
2503 
2504 /*
2505  * Link Metric handling.
2506  */
2507 static int
2508 mesh_recv_action_meshlmetric(struct ieee80211_node *ni,
2509 	const struct ieee80211_frame *wh,
2510 	const uint8_t *frm, const uint8_t *efrm)
2511 {
2512 	const struct ieee80211_meshlmetric_ie *ie =
2513 	    (const struct ieee80211_meshlmetric_ie *)
2514 	    (frm+2); /* action + code */
2515 	struct ieee80211_meshlmetric_ie lm_rep;
2516 
2517 	if (ie->lm_flags & IEEE80211_MESH_LMETRIC_FLAGS_REQ) {
2518 		lm_rep.lm_flags = 0;
2519 		lm_rep.lm_metric = mesh_airtime_calc(ni);
2520 		ieee80211_send_action(ni,
2521 		    IEEE80211_ACTION_CAT_MESH,
2522 		    IEEE80211_ACTION_MESH_LMETRIC,
2523 		    &lm_rep);
2524 	}
2525 	/* XXX: else do nothing for now */
2526 	return 0;
2527 }
2528 
2529 /*
2530  * Parse meshgate action ie's for GANN frames.
2531  * Returns -1 if parsing fails, otherwise 0.
2532  */
2533 static int
2534 mesh_parse_meshgate_action(struct ieee80211_node *ni,
2535     const struct ieee80211_frame *wh,	/* XXX for VERIFY_LENGTH */
2536     struct ieee80211_meshgann_ie *ie, const uint8_t *frm, const uint8_t *efrm)
2537 {
2538 	struct ieee80211vap *vap = ni->ni_vap;
2539 	const struct ieee80211_meshgann_ie *gannie;
2540 
2541 	while (efrm - frm > 1) {
2542 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return -1);
2543 		switch (*frm) {
2544 		case IEEE80211_ELEMID_MESHGANN:
2545 			gannie = (const struct ieee80211_meshgann_ie *) frm;
2546 			memset(ie, 0, sizeof(*ie));
2547 			ie->gann_ie = gannie->gann_ie;
2548 			ie->gann_len = gannie->gann_len;
2549 			ie->gann_flags = gannie->gann_flags;
2550 			ie->gann_hopcount = gannie->gann_hopcount;
2551 			ie->gann_ttl = gannie->gann_ttl;
2552 			IEEE80211_ADDR_COPY(ie->gann_addr, gannie->gann_addr);
2553 			ie->gann_seq = LE_READ_4(&gannie->gann_seq);
2554 			ie->gann_interval = LE_READ_2(&gannie->gann_interval);
2555 			break;
2556 		}
2557 		frm += frm[1] + 2;
2558 	}
2559 
2560 	return 0;
2561 }
2562 
2563 /*
2564  * Mesh Gate Announcement handling.
2565  */
2566 static int
2567 mesh_recv_action_meshgate(struct ieee80211_node *ni,
2568 	const struct ieee80211_frame *wh,
2569 	const uint8_t *frm, const uint8_t *efrm)
2570 {
2571 	struct ieee80211vap *vap = ni->ni_vap;
2572 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
2573 	struct ieee80211_mesh_gate_route *gr, *next;
2574 	struct ieee80211_mesh_route *rt_gate;
2575 	struct ieee80211_meshgann_ie pgann;
2576 	struct ieee80211_meshgann_ie ie;
2577 	int found = 0;
2578 
2579 	/* +2 for action + code */
2580 	if (mesh_parse_meshgate_action(ni, wh, &ie, frm+2, efrm) != 0) {
2581 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
2582 		    ni->ni_macaddr, NULL, "%s",
2583 		    "GANN parsing failed");
2584 		vap->iv_stats.is_rx_mgtdiscard++;
2585 		return (0);
2586 	}
2587 
2588 	if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ie.gann_addr))
2589 		return 0;
2590 
2591 	IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ni->ni_macaddr,
2592 	    "received GANN, meshgate: %6D (seq %u)", ie.gann_addr, ":",
2593 	    ie.gann_seq);
2594 
2595 	if (ms == NULL)
2596 		return (0);
2597 	MESH_RT_LOCK(ms);
2598 	TAILQ_FOREACH_SAFE(gr, &ms->ms_known_gates, gr_next, next) {
2599 		if (!IEEE80211_ADDR_EQ(gr->gr_addr, ie.gann_addr))
2600 			continue;
2601 		if (ie.gann_seq <= gr->gr_lastseq) {
2602 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
2603 			    ni->ni_macaddr, NULL,
2604 			    "GANN old seqno %u <= %u",
2605 			    ie.gann_seq, gr->gr_lastseq);
2606 			MESH_RT_UNLOCK(ms);
2607 			return (0);
2608 		}
2609 		/* corresponding mesh gate found & GANN accepted */
2610 		found = 1;
2611 		break;
2612 
2613 	}
2614 	if (found == 0) {
2615 		/* this GANN is from a new mesh Gate add it to known table. */
2616 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ie.gann_addr,
2617 		    "stored new GANN information, seq %u.", ie.gann_seq);
2618 		gr = IEEE80211_MALLOC(ALIGN(sizeof(struct ieee80211_mesh_gate_route)),
2619 		    M_80211_MESH_GT_RT,
2620 		    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
2621 		IEEE80211_ADDR_COPY(gr->gr_addr, ie.gann_addr);
2622 		TAILQ_INSERT_TAIL(&ms->ms_known_gates, gr, gr_next);
2623 	}
2624 	gr->gr_lastseq = ie.gann_seq;
2625 
2626 	/* check if we have a path to this gate */
2627 	rt_gate = mesh_rt_find_locked(ms, gr->gr_addr);
2628 	if (rt_gate != NULL &&
2629 	    rt_gate->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) {
2630 		gr->gr_route = rt_gate;
2631 		rt_gate->rt_flags |= IEEE80211_MESHRT_FLAGS_GATE;
2632 	}
2633 
2634 	MESH_RT_UNLOCK(ms);
2635 
2636 	/* popagate only if decremented ttl >= 1 && forwarding is enabled */
2637 	if ((ie.gann_ttl - 1) < 1 && !(ms->ms_flags & IEEE80211_MESHFLAGS_FWD))
2638 		return 0;
2639 		pgann.gann_flags = ie.gann_flags; /* Reserved */
2640 	pgann.gann_hopcount = ie.gann_hopcount + 1;
2641 	pgann.gann_ttl = ie.gann_ttl - 1;
2642 	IEEE80211_ADDR_COPY(pgann.gann_addr, ie.gann_addr);
2643 	pgann.gann_seq = ie.gann_seq;
2644 	pgann.gann_interval = ie.gann_interval;
2645 
2646 	IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ie.gann_addr,
2647 	    "%s", "propagate GANN");
2648 
2649 	ieee80211_send_action(vap->iv_bss, IEEE80211_ACTION_CAT_MESH,
2650 	    IEEE80211_ACTION_MESH_GANN, &pgann);
2651 
2652 	return 0;
2653 }
2654 
2655 static int
2656 mesh_send_action(struct ieee80211_node *ni,
2657     const uint8_t sa[IEEE80211_ADDR_LEN],
2658     const uint8_t da[IEEE80211_ADDR_LEN],
2659     struct mbuf *m)
2660 {
2661 	struct ieee80211vap *vap = ni->ni_vap;
2662 	struct ieee80211com *ic = ni->ni_ic;
2663 	struct ieee80211_bpf_params params;
2664 	struct ieee80211_frame *wh;
2665 	int ret;
2666 
2667 	KASSERT(ni != NULL, ("null node"));
2668 
2669 	if (vap->iv_state == IEEE80211_S_CAC) {
2670 		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
2671 		    "block %s frame in CAC state", "Mesh action");
2672 		vap->iv_stats.is_tx_badstate++;
2673 		ieee80211_free_node(ni);
2674 		m_freem(m);
2675 		return EIO;		/* XXX */
2676 	}
2677 
2678 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_NOWAIT);
2679 	if (m == NULL) {
2680 		ieee80211_free_node(ni);
2681 		return ENOMEM;
2682 	}
2683 
2684 	IEEE80211_TX_LOCK(ic);
2685 	wh = mtod(m, struct ieee80211_frame *);
2686 	ieee80211_send_setup(ni, m,
2687 	     IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ACTION,
2688 	     IEEE80211_NONQOS_TID, sa, da, sa);
2689 	m->m_flags |= M_ENCAP;		/* mark encapsulated */
2690 
2691 	memset(&params, 0, sizeof(params));
2692 	params.ibp_pri = WME_AC_VO;
2693 	params.ibp_rate0 = ni->ni_txparms->mgmtrate;
2694 	if (IEEE80211_IS_MULTICAST(da))
2695 		params.ibp_try0 = 1;
2696 	else
2697 		params.ibp_try0 = ni->ni_txparms->maxretry;
2698 	params.ibp_power = ni->ni_txpower;
2699 
2700 	IEEE80211_NODE_STAT(ni, tx_mgmt);
2701 
2702 	ret = ieee80211_raw_output(vap, ni, m, &params);
2703 	IEEE80211_TX_UNLOCK(ic);
2704 	return (ret);
2705 }
2706 
2707 #define	ADDSHORT(frm, v) do {			\
2708 	frm[0] = (v) & 0xff;			\
2709 	frm[1] = (v) >> 8;			\
2710 	frm += 2;				\
2711 } while (0)
2712 #define	ADDWORD(frm, v) do {			\
2713 	frm[0] = (v) & 0xff;			\
2714 	frm[1] = ((v) >> 8) & 0xff;		\
2715 	frm[2] = ((v) >> 16) & 0xff;		\
2716 	frm[3] = ((v) >> 24) & 0xff;		\
2717 	frm += 4;				\
2718 } while (0)
2719 
2720 static int
2721 mesh_send_action_meshpeering_open(struct ieee80211_node *ni,
2722 	int category, int action, void *args0)
2723 {
2724 	struct ieee80211vap *vap = ni->ni_vap;
2725 	struct ieee80211com *ic = ni->ni_ic;
2726 	uint16_t *args = args0;
2727 	const struct ieee80211_rateset *rs;
2728 	struct mbuf *m;
2729 	uint8_t *frm;
2730 
2731 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2732 	    "send PEER OPEN action: localid 0x%x", args[0]);
2733 
2734 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2735 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2736 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2737 	ieee80211_ref_node(ni);
2738 
2739 	m = ieee80211_getmgtframe(&frm,
2740 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2741 	    sizeof(uint16_t)	/* action+category */
2742 	    + sizeof(uint16_t)	/* capabilites */
2743 	    + 2 + IEEE80211_RATE_SIZE
2744 	    + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
2745 	    + 2 + IEEE80211_MESHID_LEN
2746 	    + sizeof(struct ieee80211_meshconf_ie)
2747 	    + sizeof(struct ieee80211_meshpeer_ie)
2748 	);
2749 	if (m != NULL) {
2750 		/*
2751 		 * mesh peer open action frame format:
2752 		 *   [1] category
2753 		 *   [1] action
2754 		 *   [2] capabilities
2755 		 *   [tlv] rates
2756 		 *   [tlv] xrates
2757 		 *   [tlv] mesh id
2758 		 *   [tlv] mesh conf
2759 		 *   [tlv] mesh peer link mgmt
2760 		 */
2761 		*frm++ = category;
2762 		*frm++ = action;
2763 		ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
2764 		rs = ieee80211_get_suprates(ic, ic->ic_curchan);
2765 		frm = ieee80211_add_rates(frm, rs);
2766 		frm = ieee80211_add_xrates(frm, rs);
2767 		frm = ieee80211_add_meshid(frm, vap);
2768 		frm = ieee80211_add_meshconf(frm, vap);
2769 		frm = ieee80211_add_meshpeer(frm, IEEE80211_ACTION_MESHPEERING_OPEN,
2770 		    args[0], 0, 0);
2771 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2772 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2773 	} else {
2774 		vap->iv_stats.is_tx_nobuf++;
2775 		ieee80211_free_node(ni);
2776 		return ENOMEM;
2777 	}
2778 }
2779 
2780 static int
2781 mesh_send_action_meshpeering_confirm(struct ieee80211_node *ni,
2782 	int category, int action, void *args0)
2783 {
2784 	struct ieee80211vap *vap = ni->ni_vap;
2785 	struct ieee80211com *ic = ni->ni_ic;
2786 	uint16_t *args = args0;
2787 	const struct ieee80211_rateset *rs;
2788 	struct mbuf *m;
2789 	uint8_t *frm;
2790 
2791 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2792 	    "send PEER CONFIRM action: localid 0x%x, peerid 0x%x",
2793 	    args[0], args[1]);
2794 
2795 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2796 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2797 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2798 	ieee80211_ref_node(ni);
2799 
2800 	m = ieee80211_getmgtframe(&frm,
2801 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2802 	    sizeof(uint16_t)	/* action+category */
2803 	    + sizeof(uint16_t)	/* capabilites */
2804 	    + sizeof(uint16_t)	/* status code */
2805 	    + sizeof(uint16_t)	/* AID */
2806 	    + 2 + IEEE80211_RATE_SIZE
2807 	    + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
2808 	    + 2 + IEEE80211_MESHID_LEN
2809 	    + sizeof(struct ieee80211_meshconf_ie)
2810 	    + sizeof(struct ieee80211_meshpeer_ie)
2811 	);
2812 	if (m != NULL) {
2813 		/*
2814 		 * mesh peer confirm action frame format:
2815 		 *   [1] category
2816 		 *   [1] action
2817 		 *   [2] capabilities
2818 		 *   [2] status code
2819 		 *   [2] association id (peer ID)
2820 		 *   [tlv] rates
2821 		 *   [tlv] xrates
2822 		 *   [tlv] mesh id
2823 		 *   [tlv] mesh conf
2824 		 *   [tlv] mesh peer link mgmt
2825 		 */
2826 		*frm++ = category;
2827 		*frm++ = action;
2828 		ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
2829 		ADDSHORT(frm, 0);		/* status code */
2830 		ADDSHORT(frm, args[1]);		/* AID */
2831 		rs = ieee80211_get_suprates(ic, ic->ic_curchan);
2832 		frm = ieee80211_add_rates(frm, rs);
2833 		frm = ieee80211_add_xrates(frm, rs);
2834 		frm = ieee80211_add_meshid(frm, vap);
2835 		frm = ieee80211_add_meshconf(frm, vap);
2836 		frm = ieee80211_add_meshpeer(frm,
2837 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2838 		    args[0], args[1], 0);
2839 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2840 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2841 	} else {
2842 		vap->iv_stats.is_tx_nobuf++;
2843 		ieee80211_free_node(ni);
2844 		return ENOMEM;
2845 	}
2846 }
2847 
2848 static int
2849 mesh_send_action_meshpeering_close(struct ieee80211_node *ni,
2850 	int category, int action, void *args0)
2851 {
2852 	struct ieee80211vap *vap = ni->ni_vap;
2853 	struct ieee80211com *ic = ni->ni_ic;
2854 	uint16_t *args = args0;
2855 	struct mbuf *m;
2856 	uint8_t *frm;
2857 
2858 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2859 	    "send PEER CLOSE action: localid 0x%x, peerid 0x%x reason %d",
2860 	    args[0], args[1], args[2]);
2861 
2862 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2863 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2864 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2865 	ieee80211_ref_node(ni);
2866 
2867 	m = ieee80211_getmgtframe(&frm,
2868 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2869 	    sizeof(uint16_t)	/* action+category */
2870 	    + sizeof(uint16_t)	/* reason code */
2871 	    + 2 + IEEE80211_MESHID_LEN
2872 	    + sizeof(struct ieee80211_meshpeer_ie)
2873 	);
2874 	if (m != NULL) {
2875 		/*
2876 		 * mesh peer close action frame format:
2877 		 *   [1] category
2878 		 *   [1] action
2879 		 *   [tlv] mesh id
2880 		 *   [tlv] mesh peer link mgmt
2881 		 */
2882 		*frm++ = category;
2883 		*frm++ = action;
2884 		frm = ieee80211_add_meshid(frm, vap);
2885 		frm = ieee80211_add_meshpeer(frm,
2886 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2887 		    args[0], args[1], args[2]);
2888 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2889 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2890 	} else {
2891 		vap->iv_stats.is_tx_nobuf++;
2892 		ieee80211_free_node(ni);
2893 		return ENOMEM;
2894 	}
2895 }
2896 
2897 static int
2898 mesh_send_action_meshlmetric(struct ieee80211_node *ni,
2899 	int category, int action, void *arg0)
2900 {
2901 	struct ieee80211vap *vap = ni->ni_vap;
2902 	struct ieee80211com *ic = ni->ni_ic;
2903 	struct ieee80211_meshlmetric_ie *ie = arg0;
2904 	struct mbuf *m;
2905 	uint8_t *frm;
2906 
2907 	if (ie->lm_flags & IEEE80211_MESH_LMETRIC_FLAGS_REQ) {
2908 		IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2909 		    ni, "%s", "send LINK METRIC REQUEST action");
2910 	} else {
2911 		IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2912 		    ni, "send LINK METRIC REPLY action: metric 0x%x",
2913 		    ie->lm_metric);
2914 	}
2915 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2916 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2917 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2918 	ieee80211_ref_node(ni);
2919 
2920 	m = ieee80211_getmgtframe(&frm,
2921 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2922 	    sizeof(uint16_t) +	/* action+category */
2923 	    sizeof(struct ieee80211_meshlmetric_ie)
2924 	);
2925 	if (m != NULL) {
2926 		/*
2927 		 * mesh link metric
2928 		 *   [1] category
2929 		 *   [1] action
2930 		 *   [tlv] mesh link metric
2931 		 */
2932 		*frm++ = category;
2933 		*frm++ = action;
2934 		frm = ieee80211_add_meshlmetric(frm,
2935 		    ie->lm_flags, ie->lm_metric);
2936 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2937 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2938 	} else {
2939 		vap->iv_stats.is_tx_nobuf++;
2940 		ieee80211_free_node(ni);
2941 		return ENOMEM;
2942 	}
2943 }
2944 
2945 static int
2946 mesh_send_action_meshgate(struct ieee80211_node *ni,
2947 	int category, int action, void *arg0)
2948 {
2949 	struct ieee80211vap *vap = ni->ni_vap;
2950 	struct ieee80211com *ic = ni->ni_ic;
2951 	struct ieee80211_meshgann_ie *ie = arg0;
2952 	struct mbuf *m;
2953 	uint8_t *frm;
2954 
2955 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2956 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2957 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2958 	ieee80211_ref_node(ni);
2959 
2960 	m = ieee80211_getmgtframe(&frm,
2961 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2962 	    sizeof(uint16_t) +	/* action+category */
2963 	    IEEE80211_MESHGANN_BASE_SZ
2964 	);
2965 	if (m != NULL) {
2966 		/*
2967 		 * mesh link metric
2968 		 *   [1] category
2969 		 *   [1] action
2970 		 *   [tlv] mesh gate annoucement
2971 		 */
2972 		*frm++ = category;
2973 		*frm++ = action;
2974 		frm = ieee80211_add_meshgate(frm, ie);
2975 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2976 		return mesh_send_action(ni, vap->iv_myaddr, broadcastaddr, m);
2977 	} else {
2978 		vap->iv_stats.is_tx_nobuf++;
2979 		ieee80211_free_node(ni);
2980 		return ENOMEM;
2981 	}
2982 }
2983 
2984 static void
2985 mesh_peer_timeout_setup(struct ieee80211_node *ni)
2986 {
2987 	switch (ni->ni_mlstate) {
2988 	case IEEE80211_NODE_MESH_HOLDING:
2989 		ni->ni_mltval = ieee80211_mesh_holdingtimeout;
2990 		break;
2991 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2992 		ni->ni_mltval = ieee80211_mesh_confirmtimeout;
2993 		break;
2994 	case IEEE80211_NODE_MESH_IDLE:
2995 		ni->ni_mltval = 0;
2996 		break;
2997 	default:
2998 		ni->ni_mltval = ieee80211_mesh_retrytimeout;
2999 		break;
3000 	}
3001 	if (ni->ni_mltval)
3002 		callout_reset(&ni->ni_mltimer, ni->ni_mltval,
3003 		    mesh_peer_timeout_cb, ni);
3004 }
3005 
3006 /*
3007  * Same as above but backoffs timer statisically 50%.
3008  */
3009 static void
3010 mesh_peer_timeout_backoff(struct ieee80211_node *ni)
3011 {
3012 	uint32_t r;
3013 
3014 	r = arc4random();
3015 	ni->ni_mltval += r % ni->ni_mltval;
3016 	callout_reset(&ni->ni_mltimer, ni->ni_mltval, mesh_peer_timeout_cb,
3017 	    ni);
3018 }
3019 
3020 static __inline void
3021 mesh_peer_timeout_stop(struct ieee80211_node *ni)
3022 {
3023 	callout_drain(&ni->ni_mltimer);
3024 }
3025 
3026 static void
3027 mesh_peer_backoff_cb(void *arg)
3028 {
3029 	struct ieee80211_node *ni = (struct ieee80211_node *)arg;
3030 
3031 	/* After backoff timeout, try to peer automatically again. */
3032 	ni->ni_mlhcnt = 0;
3033 }
3034 
3035 /*
3036  * Mesh Peer Link Management FSM timeout handling.
3037  */
3038 static void
3039 mesh_peer_timeout_cb(void *arg)
3040 {
3041 	struct ieee80211_node *ni = (struct ieee80211_node *)arg;
3042 	uint16_t args[3];
3043 
3044 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_MESH,
3045 	    ni, "mesh link timeout, state %d, retry counter %d",
3046 	    ni->ni_mlstate, ni->ni_mlrcnt);
3047 
3048 	switch (ni->ni_mlstate) {
3049 	case IEEE80211_NODE_MESH_IDLE:
3050 	case IEEE80211_NODE_MESH_ESTABLISHED:
3051 		break;
3052 	case IEEE80211_NODE_MESH_OPENSNT:
3053 	case IEEE80211_NODE_MESH_OPENRCV:
3054 		if (ni->ni_mlrcnt == ieee80211_mesh_maxretries) {
3055 			args[0] = ni->ni_mlpid;
3056 			args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
3057 			ieee80211_send_action(ni,
3058 			    IEEE80211_ACTION_CAT_SELF_PROT,
3059 			    IEEE80211_ACTION_MESHPEERING_CLOSE, args);
3060 			ni->ni_mlrcnt = 0;
3061 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
3062 			mesh_peer_timeout_setup(ni);
3063 		} else {
3064 			args[0] = ni->ni_mlpid;
3065 			ieee80211_send_action(ni,
3066 			    IEEE80211_ACTION_CAT_SELF_PROT,
3067 			    IEEE80211_ACTION_MESHPEERING_OPEN, args);
3068 			ni->ni_mlrcnt++;
3069 			mesh_peer_timeout_backoff(ni);
3070 		}
3071 		break;
3072 	case IEEE80211_NODE_MESH_CONFIRMRCV:
3073 		args[0] = ni->ni_mlpid;
3074 		args[2] = IEEE80211_REASON_MESH_CONFIRM_TIMEOUT;
3075 		ieee80211_send_action(ni,
3076 		    IEEE80211_ACTION_CAT_SELF_PROT,
3077 		    IEEE80211_ACTION_MESHPEERING_CLOSE, args);
3078 		mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
3079 		mesh_peer_timeout_setup(ni);
3080 		break;
3081 	case IEEE80211_NODE_MESH_HOLDING:
3082 		ni->ni_mlhcnt++;
3083 		if (ni->ni_mlhcnt >= ieee80211_mesh_maxholding)
3084 			callout_reset(&ni->ni_mlhtimer,
3085 			    ieee80211_mesh_backofftimeout,
3086 			    mesh_peer_backoff_cb, ni);
3087 		mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
3088 		break;
3089 	}
3090 }
3091 
3092 static int
3093 mesh_verify_meshid(struct ieee80211vap *vap, const uint8_t *ie)
3094 {
3095 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3096 
3097 	if (ie == NULL || ie[1] != ms->ms_idlen)
3098 		return 1;
3099 	return memcmp(ms->ms_id, ie + 2, ms->ms_idlen);
3100 }
3101 
3102 /*
3103  * Check if we are using the same algorithms for this mesh.
3104  */
3105 static int
3106 mesh_verify_meshconf(struct ieee80211vap *vap, const uint8_t *ie)
3107 {
3108 	const struct ieee80211_meshconf_ie *meshconf =
3109 	    (const struct ieee80211_meshconf_ie *) ie;
3110 	const struct ieee80211_mesh_state *ms = vap->iv_mesh;
3111 
3112 	if (meshconf == NULL)
3113 		return 1;
3114 	if (meshconf->conf_pselid != ms->ms_ppath->mpp_ie) {
3115 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3116 		    "unknown path selection algorithm: 0x%x\n",
3117 		    meshconf->conf_pselid);
3118 		return 1;
3119 	}
3120 	if (meshconf->conf_pmetid != ms->ms_pmetric->mpm_ie) {
3121 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3122 		    "unknown path metric algorithm: 0x%x\n",
3123 		    meshconf->conf_pmetid);
3124 		return 1;
3125 	}
3126 	if (meshconf->conf_ccid != 0) {
3127 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3128 		    "unknown congestion control algorithm: 0x%x\n",
3129 		    meshconf->conf_ccid);
3130 		return 1;
3131 	}
3132 	if (meshconf->conf_syncid != IEEE80211_MESHCONF_SYNC_NEIGHOFF) {
3133 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3134 		    "unknown sync algorithm: 0x%x\n",
3135 		    meshconf->conf_syncid);
3136 		return 1;
3137 	}
3138 	if (meshconf->conf_authid != 0) {
3139 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3140 		    "unknown auth auth algorithm: 0x%x\n",
3141 		    meshconf->conf_pselid);
3142 		return 1;
3143 	}
3144 	/* Not accepting peers */
3145 	if (!(meshconf->conf_cap & IEEE80211_MESHCONF_CAP_AP)) {
3146 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3147 		    "not accepting peers: 0x%x\n", meshconf->conf_cap);
3148 		return 1;
3149 	}
3150 	return 0;
3151 }
3152 
3153 static int
3154 mesh_verify_meshpeer(struct ieee80211vap *vap, uint8_t subtype,
3155     const uint8_t *ie)
3156 {
3157 	const struct ieee80211_meshpeer_ie *meshpeer =
3158 	    (const struct ieee80211_meshpeer_ie *) ie;
3159 
3160 	if (meshpeer == NULL ||
3161 	    meshpeer->peer_len < IEEE80211_MPM_BASE_SZ ||
3162 	    meshpeer->peer_len > IEEE80211_MPM_MAX_SZ)
3163 		return 1;
3164 	if (meshpeer->peer_proto != IEEE80211_MPPID_MPM) {
3165 		IEEE80211_DPRINTF(vap,
3166 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
3167 		    "Only MPM protocol is supported (proto: 0x%02X)",
3168 		    meshpeer->peer_proto);
3169 		return 1;
3170 	}
3171 	switch (subtype) {
3172 	case IEEE80211_ACTION_MESHPEERING_OPEN:
3173 		if (meshpeer->peer_len != IEEE80211_MPM_BASE_SZ)
3174 			return 1;
3175 		break;
3176 	case IEEE80211_ACTION_MESHPEERING_CONFIRM:
3177 		if (meshpeer->peer_len != IEEE80211_MPM_BASE_SZ + 2)
3178 			return 1;
3179 		break;
3180 	case IEEE80211_ACTION_MESHPEERING_CLOSE:
3181 		if (meshpeer->peer_len < IEEE80211_MPM_BASE_SZ + 2)
3182 			return 1;
3183 		if (meshpeer->peer_len == (IEEE80211_MPM_BASE_SZ + 2) &&
3184 		    meshpeer->peer_linkid != 0)
3185 			return 1;
3186 		if (meshpeer->peer_rcode == 0)
3187 			return 1;
3188 		break;
3189 	}
3190 	return 0;
3191 }
3192 
3193 /*
3194  * Add a Mesh ID IE to a frame.
3195  */
3196 uint8_t *
3197 ieee80211_add_meshid(uint8_t *frm, struct ieee80211vap *vap)
3198 {
3199 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3200 
3201 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a mbss vap"));
3202 
3203 	*frm++ = IEEE80211_ELEMID_MESHID;
3204 	*frm++ = ms->ms_idlen;
3205 	memcpy(frm, ms->ms_id, ms->ms_idlen);
3206 	return frm + ms->ms_idlen;
3207 }
3208 
3209 /*
3210  * Add a Mesh Configuration IE to a frame.
3211  * For now just use HWMP routing, Airtime link metric, Null Congestion
3212  * Signaling, Null Sync Protocol and Null Authentication.
3213  */
3214 uint8_t *
3215 ieee80211_add_meshconf(uint8_t *frm, struct ieee80211vap *vap)
3216 {
3217 	const struct ieee80211_mesh_state *ms = vap->iv_mesh;
3218 	uint16_t caps;
3219 
3220 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
3221 
3222 	*frm++ = IEEE80211_ELEMID_MESHCONF;
3223 	*frm++ = IEEE80211_MESH_CONF_SZ;
3224 	*frm++ = ms->ms_ppath->mpp_ie;		/* path selection */
3225 	*frm++ = ms->ms_pmetric->mpm_ie;	/* link metric */
3226 	*frm++ = IEEE80211_MESHCONF_CC_DISABLED;
3227 	*frm++ = IEEE80211_MESHCONF_SYNC_NEIGHOFF;
3228 	*frm++ = IEEE80211_MESHCONF_AUTH_DISABLED;
3229 	/* NB: set the number of neighbors before the rest */
3230 	*frm = (ms->ms_neighbors > IEEE80211_MESH_MAX_NEIGHBORS ?
3231 	    IEEE80211_MESH_MAX_NEIGHBORS : ms->ms_neighbors) << 1;
3232 	if (ms->ms_flags & IEEE80211_MESHFLAGS_GATE)
3233 		*frm |= IEEE80211_MESHCONF_FORM_GATE;
3234 	frm += 1;
3235 	caps = 0;
3236 	if (ms->ms_flags & IEEE80211_MESHFLAGS_AP)
3237 		caps |= IEEE80211_MESHCONF_CAP_AP;
3238 	if (ms->ms_flags & IEEE80211_MESHFLAGS_FWD)
3239 		caps |= IEEE80211_MESHCONF_CAP_FWRD;
3240 	*frm++ = caps;
3241 	return frm;
3242 }
3243 
3244 /*
3245  * Add a Mesh Peer Management IE to a frame.
3246  */
3247 uint8_t *
3248 ieee80211_add_meshpeer(uint8_t *frm, uint8_t subtype, uint16_t localid,
3249     uint16_t peerid, uint16_t reason)
3250 {
3251 
3252 	KASSERT(localid != 0, ("localid == 0"));
3253 
3254 	*frm++ = IEEE80211_ELEMID_MESHPEER;
3255 	switch (subtype) {
3256 	case IEEE80211_ACTION_MESHPEERING_OPEN:
3257 		*frm++ = IEEE80211_MPM_BASE_SZ;		/* length */
3258 		ADDSHORT(frm, IEEE80211_MPPID_MPM);	/* proto */
3259 		ADDSHORT(frm, localid);			/* local ID */
3260 		break;
3261 	case IEEE80211_ACTION_MESHPEERING_CONFIRM:
3262 		KASSERT(peerid != 0, ("sending peer confirm without peer id"));
3263 		*frm++ = IEEE80211_MPM_BASE_SZ + 2;	/* length */
3264 		ADDSHORT(frm, IEEE80211_MPPID_MPM);	/* proto */
3265 		ADDSHORT(frm, localid);			/* local ID */
3266 		ADDSHORT(frm, peerid);			/* peer ID */
3267 		break;
3268 	case IEEE80211_ACTION_MESHPEERING_CLOSE:
3269 		if (peerid)
3270 			*frm++ = IEEE80211_MPM_MAX_SZ;	/* length */
3271 		else
3272 			*frm++ = IEEE80211_MPM_BASE_SZ + 2; /* length */
3273 		ADDSHORT(frm, IEEE80211_MPPID_MPM);	/* proto */
3274 		ADDSHORT(frm, localid);	/* local ID */
3275 		if (peerid)
3276 			ADDSHORT(frm, peerid);	/* peer ID */
3277 		ADDSHORT(frm, reason);
3278 		break;
3279 	}
3280 	return frm;
3281 }
3282 
3283 /*
3284  * Compute an Airtime Link Metric for the link with this node.
3285  *
3286  * Based on Draft 3.0 spec (11B.10, p.149).
3287  */
3288 /*
3289  * Max 802.11s overhead.
3290  */
3291 #define IEEE80211_MESH_MAXOVERHEAD \
3292 	(sizeof(struct ieee80211_qosframe_addr4) \
3293 	 + sizeof(struct ieee80211_meshcntl_ae10) \
3294 	+ sizeof(struct llc) \
3295 	+ IEEE80211_ADDR_LEN \
3296 	+ IEEE80211_WEP_IVLEN \
3297 	+ IEEE80211_WEP_KIDLEN \
3298 	+ IEEE80211_WEP_CRCLEN \
3299 	+ IEEE80211_WEP_MICLEN \
3300 	+ IEEE80211_CRC_LEN)
3301 uint32_t
3302 mesh_airtime_calc(struct ieee80211_node *ni)
3303 {
3304 #define M_BITS 8
3305 #define S_FACTOR (2 * M_BITS)
3306 	struct ieee80211com *ic = ni->ni_ic;
3307 	struct ifnet *ifp = ni->ni_vap->iv_ifp;
3308 	const static int nbits = 8192 << M_BITS;
3309 	uint32_t overhead, rate, errrate;
3310 	uint64_t res;
3311 
3312 	/* Time to transmit a frame */
3313 	rate = ni->ni_txrate;
3314 	overhead = ieee80211_compute_duration(ic->ic_rt,
3315 	    ifp->if_mtu + IEEE80211_MESH_MAXOVERHEAD, rate, 0) << M_BITS;
3316 	/* Error rate in percentage */
3317 	/* XXX assuming small failures are ok */
3318 	errrate = (((ifp->if_get_counter(ifp, IFCOUNTER_OERRORS) +
3319 	    ifp->if_get_counter(ifp, IFCOUNTER_IERRORS)) / 100) << M_BITS)
3320 	    / 100;
3321 	res = (overhead + (nbits / rate)) *
3322 	    ((1 << S_FACTOR) / ((1 << M_BITS) - errrate));
3323 
3324 	return (uint32_t)(res >> S_FACTOR);
3325 #undef M_BITS
3326 #undef S_FACTOR
3327 }
3328 
3329 /*
3330  * Add a Mesh Link Metric report IE to a frame.
3331  */
3332 uint8_t *
3333 ieee80211_add_meshlmetric(uint8_t *frm, uint8_t flags, uint32_t metric)
3334 {
3335 	*frm++ = IEEE80211_ELEMID_MESHLINK;
3336 	*frm++ = 5;
3337 	*frm++ = flags;
3338 	ADDWORD(frm, metric);
3339 	return frm;
3340 }
3341 
3342 /*
3343  * Add a Mesh Gate Announcement IE to a frame.
3344  */
3345 uint8_t *
3346 ieee80211_add_meshgate(uint8_t *frm, struct ieee80211_meshgann_ie *ie)
3347 {
3348 	*frm++ = IEEE80211_ELEMID_MESHGANN; /* ie */
3349 	*frm++ = IEEE80211_MESHGANN_BASE_SZ; /* len */
3350 	*frm++ = ie->gann_flags;
3351 	*frm++ = ie->gann_hopcount;
3352 	*frm++ = ie->gann_ttl;
3353 	IEEE80211_ADDR_COPY(frm, ie->gann_addr);
3354 	frm += 6;
3355 	ADDWORD(frm, ie->gann_seq);
3356 	ADDSHORT(frm, ie->gann_interval);
3357 	return frm;
3358 }
3359 #undef ADDSHORT
3360 #undef ADDWORD
3361 
3362 /*
3363  * Initialize any mesh-specific node state.
3364  */
3365 void
3366 ieee80211_mesh_node_init(struct ieee80211vap *vap, struct ieee80211_node *ni)
3367 {
3368 	ni->ni_flags |= IEEE80211_NODE_QOS;
3369 	callout_init(&ni->ni_mltimer, 1);
3370 	callout_init(&ni->ni_mlhtimer, 1);
3371 }
3372 
3373 /*
3374  * Cleanup any mesh-specific node state.
3375  */
3376 void
3377 ieee80211_mesh_node_cleanup(struct ieee80211_node *ni)
3378 {
3379 	struct ieee80211vap *vap = ni->ni_vap;
3380 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3381 
3382 	callout_drain(&ni->ni_mltimer);
3383 	callout_drain(&ni->ni_mlhtimer);
3384 	/* NB: short-circuit callbacks after mesh_vdetach */
3385 	if (vap->iv_mesh != NULL)
3386 		ms->ms_ppath->mpp_peerdown(ni);
3387 }
3388 
3389 void
3390 ieee80211_parse_meshid(struct ieee80211_node *ni, const uint8_t *ie)
3391 {
3392 	ni->ni_meshidlen = ie[1];
3393 	memcpy(ni->ni_meshid, ie + 2, ie[1]);
3394 }
3395 
3396 /*
3397  * Setup mesh-specific node state on neighbor discovery.
3398  */
3399 void
3400 ieee80211_mesh_init_neighbor(struct ieee80211_node *ni,
3401 	const struct ieee80211_frame *wh,
3402 	const struct ieee80211_scanparams *sp)
3403 {
3404 	ieee80211_parse_meshid(ni, sp->meshid);
3405 }
3406 
3407 void
3408 ieee80211_mesh_update_beacon(struct ieee80211vap *vap,
3409 	struct ieee80211_beacon_offsets *bo)
3410 {
3411 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
3412 
3413 	if (isset(bo->bo_flags, IEEE80211_BEACON_MESHCONF)) {
3414 		(void)ieee80211_add_meshconf(bo->bo_meshconf, vap);
3415 		clrbit(bo->bo_flags, IEEE80211_BEACON_MESHCONF);
3416 	}
3417 }
3418 
3419 static int
3420 mesh_ioctl_get80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
3421 {
3422 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3423 	uint8_t tmpmeshid[IEEE80211_NWID_LEN];
3424 	struct ieee80211_mesh_route *rt;
3425 	struct ieee80211req_mesh_route *imr;
3426 	size_t len, off;
3427 	uint8_t *p;
3428 	int error;
3429 
3430 	if (vap->iv_opmode != IEEE80211_M_MBSS)
3431 		return ENOSYS;
3432 
3433 	error = 0;
3434 	switch (ireq->i_type) {
3435 	case IEEE80211_IOC_MESH_ID:
3436 		ireq->i_len = ms->ms_idlen;
3437 		memcpy(tmpmeshid, ms->ms_id, ireq->i_len);
3438 		error = copyout(tmpmeshid, ireq->i_data, ireq->i_len);
3439 		break;
3440 	case IEEE80211_IOC_MESH_AP:
3441 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_AP) != 0;
3442 		break;
3443 	case IEEE80211_IOC_MESH_FWRD:
3444 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_FWD) != 0;
3445 		break;
3446 	case IEEE80211_IOC_MESH_GATE:
3447 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_GATE) != 0;
3448 		break;
3449 	case IEEE80211_IOC_MESH_TTL:
3450 		ireq->i_val = ms->ms_ttl;
3451 		break;
3452 	case IEEE80211_IOC_MESH_RTCMD:
3453 		switch (ireq->i_val) {
3454 		case IEEE80211_MESH_RTCMD_LIST:
3455 			len = 0;
3456 			MESH_RT_LOCK(ms);
3457 			TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
3458 				len += sizeof(*imr);
3459 			}
3460 			MESH_RT_UNLOCK(ms);
3461 			if (len > ireq->i_len || ireq->i_len < sizeof(*imr)) {
3462 				ireq->i_len = len;
3463 				return ENOMEM;
3464 			}
3465 			ireq->i_len = len;
3466 			/* XXX M_WAIT? */
3467 			p = IEEE80211_MALLOC(len, M_TEMP,
3468 			    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
3469 			if (p == NULL)
3470 				return ENOMEM;
3471 			off = 0;
3472 			MESH_RT_LOCK(ms);
3473 			TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
3474 				if (off >= len)
3475 					break;
3476 				imr = (struct ieee80211req_mesh_route *)
3477 				    (p + off);
3478 				IEEE80211_ADDR_COPY(imr->imr_dest,
3479 				    rt->rt_dest);
3480 				IEEE80211_ADDR_COPY(imr->imr_nexthop,
3481 				    rt->rt_nexthop);
3482 				imr->imr_metric = rt->rt_metric;
3483 				imr->imr_nhops = rt->rt_nhops;
3484 				imr->imr_lifetime =
3485 				    ieee80211_mesh_rt_update(rt, 0);
3486 				imr->imr_lastmseq = rt->rt_lastmseq;
3487 				imr->imr_flags = rt->rt_flags; /* last */
3488 				off += sizeof(*imr);
3489 			}
3490 			MESH_RT_UNLOCK(ms);
3491 			error = copyout(p, (uint8_t *)ireq->i_data,
3492 			    ireq->i_len);
3493 			IEEE80211_FREE(p, M_TEMP);
3494 			break;
3495 		case IEEE80211_MESH_RTCMD_FLUSH:
3496 		case IEEE80211_MESH_RTCMD_ADD:
3497 		case IEEE80211_MESH_RTCMD_DELETE:
3498 			return EINVAL;
3499 		default:
3500 			return ENOSYS;
3501 		}
3502 		break;
3503 	case IEEE80211_IOC_MESH_PR_METRIC:
3504 		len = strlen(ms->ms_pmetric->mpm_descr);
3505 		if (ireq->i_len < len)
3506 			return EINVAL;
3507 		ireq->i_len = len;
3508 		error = copyout(ms->ms_pmetric->mpm_descr,
3509 		    (uint8_t *)ireq->i_data, len);
3510 		break;
3511 	case IEEE80211_IOC_MESH_PR_PATH:
3512 		len = strlen(ms->ms_ppath->mpp_descr);
3513 		if (ireq->i_len < len)
3514 			return EINVAL;
3515 		ireq->i_len = len;
3516 		error = copyout(ms->ms_ppath->mpp_descr,
3517 		    (uint8_t *)ireq->i_data, len);
3518 		break;
3519 	default:
3520 		return ENOSYS;
3521 	}
3522 
3523 	return error;
3524 }
3525 IEEE80211_IOCTL_GET(mesh, mesh_ioctl_get80211);
3526 
3527 static int
3528 mesh_ioctl_set80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
3529 {
3530 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3531 	uint8_t tmpmeshid[IEEE80211_NWID_LEN];
3532 	uint8_t tmpaddr[IEEE80211_ADDR_LEN];
3533 	char tmpproto[IEEE80211_MESH_PROTO_DSZ];
3534 	int error;
3535 
3536 	if (vap->iv_opmode != IEEE80211_M_MBSS)
3537 		return ENOSYS;
3538 
3539 	error = 0;
3540 	switch (ireq->i_type) {
3541 	case IEEE80211_IOC_MESH_ID:
3542 		if (ireq->i_val != 0 || ireq->i_len > IEEE80211_MESHID_LEN)
3543 			return EINVAL;
3544 		error = copyin(ireq->i_data, tmpmeshid, ireq->i_len);
3545 		if (error != 0)
3546 			break;
3547 		memset(ms->ms_id, 0, IEEE80211_NWID_LEN);
3548 		ms->ms_idlen = ireq->i_len;
3549 		memcpy(ms->ms_id, tmpmeshid, ireq->i_len);
3550 		error = ENETRESET;
3551 		break;
3552 	case IEEE80211_IOC_MESH_AP:
3553 		if (ireq->i_val)
3554 			ms->ms_flags |= IEEE80211_MESHFLAGS_AP;
3555 		else
3556 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_AP;
3557 		error = ENETRESET;
3558 		break;
3559 	case IEEE80211_IOC_MESH_FWRD:
3560 		if (ireq->i_val)
3561 			ms->ms_flags |= IEEE80211_MESHFLAGS_FWD;
3562 		else
3563 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_FWD;
3564 		mesh_gatemode_setup(vap);
3565 		break;
3566 	case IEEE80211_IOC_MESH_GATE:
3567 		if (ireq->i_val)
3568 			ms->ms_flags |= IEEE80211_MESHFLAGS_GATE;
3569 		else
3570 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_GATE;
3571 		break;
3572 	case IEEE80211_IOC_MESH_TTL:
3573 		ms->ms_ttl = (uint8_t) ireq->i_val;
3574 		break;
3575 	case IEEE80211_IOC_MESH_RTCMD:
3576 		switch (ireq->i_val) {
3577 		case IEEE80211_MESH_RTCMD_LIST:
3578 			return EINVAL;
3579 		case IEEE80211_MESH_RTCMD_FLUSH:
3580 			ieee80211_mesh_rt_flush(vap);
3581 			break;
3582 		case IEEE80211_MESH_RTCMD_ADD:
3583 			if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ireq->i_data) ||
3584 			    IEEE80211_ADDR_EQ(broadcastaddr, ireq->i_data))
3585 				return EINVAL;
3586 			error = copyin(ireq->i_data, &tmpaddr,
3587 			    IEEE80211_ADDR_LEN);
3588 			if (error == 0)
3589 				ieee80211_mesh_discover(vap, tmpaddr, NULL);
3590 			break;
3591 		case IEEE80211_MESH_RTCMD_DELETE:
3592 			ieee80211_mesh_rt_del(vap, ireq->i_data);
3593 			break;
3594 		default:
3595 			return ENOSYS;
3596 		}
3597 		break;
3598 	case IEEE80211_IOC_MESH_PR_METRIC:
3599 		error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
3600 		if (error == 0) {
3601 			error = mesh_select_proto_metric(vap, tmpproto);
3602 			if (error == 0)
3603 				error = ENETRESET;
3604 		}
3605 		break;
3606 	case IEEE80211_IOC_MESH_PR_PATH:
3607 		error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
3608 		if (error == 0) {
3609 			error = mesh_select_proto_path(vap, tmpproto);
3610 			if (error == 0)
3611 				error = ENETRESET;
3612 		}
3613 		break;
3614 	default:
3615 		return ENOSYS;
3616 	}
3617 	return error;
3618 }
3619 IEEE80211_IOCTL_SET(mesh, mesh_ioctl_set80211);
3620